Patent Description:
<CIT> describes source code vulnerability remediation that may include receiving source code that includes a vulnerability, and receiving remediated code that remediates the vulnerability associated with the source code. A machine learning model may be trained to analyze a vulnerable code snippet of the source code. The vulnerable code snippet may correspond to the vulnerability associated with the source code. The machine learning model may be trained to generate, for the vulnerable code snippet, a remediated code snippet to remediate the vulnerability associated with the source code. The remediated code snippet may be validated based on an analysis of whether the remediated code snippet remediates the vulnerability associated with the source code.

<CIT> describes a method that includes receiving code for computer programming, determining whether a portion of the code comprises a vulnerability, and comparing the portion of the code comprising the vulnerability to a knowledge base. The knowledge base comprises (i) code fragments comprising vulnerabilities; and (ii) solutions to prevent corresponding ones of the vulnerabilities. The method further includes identifying, based on the comparing, a code fragment of the code fragments matching the portion of the code comprising the vulnerability, and executing a solution of the solutions corresponding to the identified code fragment to prevent the vulnerability in the portion of the code.

Source code differential pruning-based dataset creation apparatuses, methods for source code differential pruning-based dataset creation, and non-transitory computer readable media having stored thereon machine readable instructions to provide source code differential pruning-based dataset creation are disclosed herein. The apparatuses, methods, and non-transitory computer readable media disclosed herein provide for implementation of differential pruning to segregate irrelevant data from the relevant data. In this regard, the differential pruning as disclosed herein may represent a machine learning model-based approach that utilizes unsupervised and supervised learning. For the apparatuses, methods, and non-transitory computer readable media disclosed herein, as a first step, a dataset may be utilized to generate a K-nearest neighbor search space, where the dataset is divided into sentences and clustered. As a next step, a score may be determined for each sentence based on a number of sentences available in an associated cluster. If the score is greater than a specified threshold, the sentence may be classified as relevant within the dataset, or otherwise, the sentence may be classified as not relevant. Based on this analysis, the data for a dataset may be classified as noise (e.g., irrelevant data) or relevant data.

With respect to the apparatuses, methods, and non-transitory computer readable media disclosed herein, in order for machine translation to translate vulnerable code to the remediated code, it is technically challenging to generate data that includes vulnerable code and remediated code. In this regard, source code may typically include a fix (e.g., remediation) for a vulnerability, with the source code being committed to a source code repository.

In some cases, a commit identification (ID) may be utilized to fix a vulnerability and to commit the source code, which leads to a possibility of extracting a vulnerability from the commits based on the commit ID and its description. However, there may be instances where the same commit ID is used for committing functional and other issues. These attributes of a commit ID may lead to noise in a dataset, with the noise representing irrelevant data that needs to be avoided. In some cases, more than <NUM>% of the commit IDs may include noise.

In some cases, a supervised learning technique may utilize support from a subject matter expert (SME) in different languages to label data manually, and create a dataset that may be denoted a tagged dataset. However, with respect to supervised learning, it is technically challenging to scale this approach to a relatively large dataset due to the need for manual labelling of the dataset.

Compared to the aforementioned supervised learning technique, a modified technique may initially include labelling a dataset using supervised learning, and thereafter utilizing the labeled dataset as a model to label new data. However, with respect to this modified approach, a quality of the resulting labeling may depend on a size and/or accuracy of the initially labeled dataset that is used to generate the model. If the size and/or accuracy of the initially labeled dataset is inadequate, the resulting model may generate low quality results with respect to subsequent labelling of a dataset.

In order to address at least the aforementioned technical challenges related to generation of data that includes vulnerable code and remediated code, the apparatuses, methods, and non-transitory computer readable media disclosed herein may implement differential pruning to identify relevant source code that includes vulnerable code and remediated code, compared to irrelevant source code.

For the apparatuses, methods, and non-transitory computer readable media disclosed herein, with respect to the application of differential pruning, data that occurs repeatedly may be assumed to be relevant and related to a vulnerability and remediated fix. If a commit ID or commit description mentions a Common Vulnerabilities and Exposures (CVE) ID, or any vulnerability name or description such as Structured Query Language (SQL) Injection, the data may be considered to include SQL Injection related data. Further, the data may include some functional or other fixes. If SQL Injection related data is extracted from the source code, the data may include repeated pairs of SQL Injection related fixes.

For the apparatuses, methods, and non-transitory computer readable media disclosed herein, the elements of the apparatuses, methods, and non-transitory computer readable media disclosed herein may be any combination of hardware and programming to implement the functionalities of the respective elements. In some examples described herein, the combinations of hardware and programming may be implemented in a number of different ways. For example, the programming for the elements may be processor executable instructions stored on a non-transitory machine-readable storage medium and the hardware for the elements may include a processing resource to execute those instructions. In these examples, a computing device implementing such elements may include the machine-readable storage medium storing the instructions and the processing resource to execute the instructions, or the machine-readable storage medium may be separately stored and accessible by the computing device and the processing resource. In some examples, some elements may be implemented in circuitry.

<FIG> illustrates a layout of an example source code differential pruning-based dataset creation apparatus (hereinafter also referred to as "apparatus <NUM>").

Referring to <FIG>, the apparatus <NUM> may include a source code analyzer <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) to receive source code <NUM> that includes at least one vulnerability <NUM> and at least one remediation <NUM> that remediates the at least one vulnerability <NUM>. The source code analyzer <NUM> may extract, from the source code <NUM>, at least one remediated section <NUM>. The source code analyzer <NUM> may identify, from the extracted at least one remediated section <NUM>, each sentence of the at least one remediated section <NUM>.

A cluster generator <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may generate, based on an analysis of each identified sentence <NUM> of the at least one remediated section <NUM>, a plurality of clusters <NUM>. The cluster generator <NUM> may determine, for each identified sentence of a specified cluster of the plurality of clusters <NUM>, a score <NUM> with respect to the specified cluster that includes the identified sentence.

An auxiliary dataset generator <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may determine, for each identified sentence of the specified cluster of the plurality of clusters <NUM>, whether the score <NUM> is greater than a specified threshold <NUM>. The auxiliary dataset generator <NUM> may designate each identified sentence of the specified cluster of the plurality of clusters <NUM> for which the score <NUM> is greater than the specified threshold <NUM> as a relevant sentence. The auxiliary dataset generator <NUM> may generate, based on a plurality of relevant sentences <NUM>, an auxiliary dataset <NUM> that includes at least one relevant vulnerability and at least one relevant remediation that remediates the at least one relevant vulnerability.

According to examples disclosed herein, the cluster generator <NUM> may generate, based on the analysis of each identified sentence of the at least one remediated section <NUM>, the plurality of clusters <NUM> by generating, based on the analysis of each identified sentence of the at least one remediated section <NUM>, the plurality of clusters in a k-nearest neighbors (KNN) search space.

A source code remediation machine learning model trainer <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may train at least one source code remediation machine learning model <NUM> by analyzing, from the auxiliary dataset <NUM>, the at least one relevant vulnerability associated with the source code <NUM>. The source code remediation machine learning model trainer <NUM> may analyze, from the auxiliary dataset <NUM> and for the at least one relevant vulnerability associated with the source code, the at least one relevant remediation that remediates the at least one relevant vulnerability.

A source code receiver <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may receive further source code <NUM> that includes at least one further vulnerability.

A source code transformer <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may receive, from the at least one trained source code remediation machine learning model <NUM>, a further remediated code to remediate the at least one further vulnerability associated with the further source code <NUM>. The source code transformer <NUM> may transform, based on the further remediated code, the further source code <NUM> to remediate the at least one further vulnerability associated with the further source code <NUM>. For example, remediating a vulnerable code line to a non-vulnerable code line may include transforming a sequence of tokens to another sequence of tokens. The transformation may be performed using a deep neural network model (e.g., the source code remediation machine learning model <NUM>) that includes an encoder-decoder architecture with an attention mechanism. Given a sequence of tokens, the deep neural network model may predict the output sequence of tokens. Before the input sequence is entered to the deep neural network model, the sequence may be abstracted. All user-defined variables and literals may be replaced with generic names such as ID1, STR1, NUM1, etc. The deep neural network model may predict the output sequence with those generic names. The generic names in the output sequence may be replaced with the original names after the prediction.

An auxiliary dataset generation machine learning model trainer <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may train at least one auxiliary dataset generation machine learning model <NUM> by analyzing, from the auxiliary dataset <NUM>, the at least one relevant vulnerability associated with the source code <NUM>. The auxiliary dataset generation machine learning model trainer <NUM> may analyze, from the auxiliary dataset <NUM> and for the at least one relevant vulnerability associated with the source code <NUM>, the at least one relevant remediation that remediates the at least one relevant vulnerability.

A further auxiliary dataset generation source code receiver <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may receive further auxiliary dataset generation source code <NUM> that includes at least one further vulnerability.

A further auxiliary dataset generator <NUM> that is executed by at least one hardware processor (e.g., the hardware processor <NUM> of <FIG>, and/or the hardware processor <NUM> of <FIG>) may receive, from the at least one trained auxiliary dataset generation machine learning model <NUM>, at least one further remediation to remediate the at least one further vulnerability associated with the further auxiliary dataset generation source code <NUM>. The further auxiliary dataset generator <NUM> may generate, based on the at least one further remediation, a further auxiliary dataset <NUM> that includes the at least one further remediation associated with the at least one further vulnerability associated with the further auxiliary dataset generation source code <NUM>.

Operation of the apparatus <NUM> is described in further detail with reference to <FIG>.

<FIG> illustrates relevant versus irrelevant data to illustrate operation of the apparatus <NUM>, in accordance with an example of the present disclosure.

Referring to <FIG> and <FIG>, the source code analyzer <NUM> may receive source code <NUM> that includes at least one vulnerability <NUM> and at least one remediation <NUM> that remediates the at least one vulnerability <NUM>. The source code analyzer <NUM> may extract, from the source code <NUM>, at least one remediated section <NUM>. The source code analyzer <NUM> may identify, from the extracted at least one remediated section <NUM>, each sentence of the at least one remediated section <NUM>. For example, as shown in <FIG>, the source code analyzer <NUM> may identify relevant data such as the data <NUM> for machine learning. For example, the data <NUM> may include a fix such as "Use prepared statement and executeBatch (properly)". Similarly, the source code analyzer <NUM> may identify irrelevant data such as the data <NUM>.

<FIG> illustrates further details of an architecture of the apparatus <NUM>, in accordance with an example of the present disclosure.

Referring to <FIG> and <FIG>, at <NUM>, the source code <NUM> (e.g., initial dataset) may include mixed data including relevant and irrelevant information. The source code analyzer <NUM> may extract, from the source code <NUM>, at least one remediated section <NUM>. The source code analyzer <NUM> may identify, from the extracted at least one remediated section <NUM>, each sentence of the at least one remediated section <NUM>. Thus, the source code analyzer <NUM> may extract a remediated section of the initial dataset and divide the data of the initial dataset sentence by sentence.

At <NUM>, the cluster generator <NUM> may generate, based on an analysis of each identified sentence <NUM> of the at least one remediated section <NUM>, a plurality of clusters <NUM>. The cluster generator <NUM> may determine, for each identified sentence of a specified cluster of the plurality of clusters <NUM>, a score <NUM> with respect to the specified cluster that includes the identified sentence. Thus, the cluster generator <NUM> may generate clusters <NUM> to create a cluster space. In this regard, the cluster generator <NUM> may implement a sentence transformer to add sentence by sentence in an encoder. With respect to the generated clusters <NUM>, once all of the data has been allocated and added into the search space, a semantic search may be performed on the clusters to provide a score as follows:
{'corpus_id': <NUM>, 'score': <NUM>}
For each specific sentence, a corpus identification (ID) and score may be provided.

At <NUM>, the auxiliary dataset generator <NUM> may determine, for each identified sentence of the specified cluster of the plurality of clusters <NUM>, whether the score <NUM> is greater than a specified threshold <NUM>. The auxiliary dataset generator <NUM> may designate each identified sentence of the specified cluster of the plurality of clusters <NUM> for which the score <NUM> is greater than the specified threshold <NUM> as a relevant sentence. The auxiliary dataset generator <NUM> may generate, based on a plurality of relevant sentences <NUM>, an auxiliary dataset <NUM> that includes at least one relevant vulnerability and at least one relevant remediation that remediates the at least one relevant vulnerability.

At <NUM>, the source code remediation machine learning model trainer <NUM> may train at least one source code remediation machine learning model <NUM> by analyzing, from the auxiliary dataset <NUM>, the at least one relevant vulnerability associated with the source code <NUM>. The source code remediation machine learning model trainer <NUM> may analyze, from the auxiliary dataset <NUM> and for the at least one relevant vulnerability associated with the source code, the at least one relevant remediation that remediates the at least one relevant vulnerability.

At <NUM>, the source code remediation machine learning model <NUM> may be deployed with respect to differential pruning of further source code.

<FIG> illustrates operation of a sentence transformer encoder of apparatus <NUM>, in accordance with an example of the present disclosure.

Referring to <FIG> and <FIG>, remediated code from the source code <NUM> (e.g., initial dataset) is shown at <NUM>. In this regard, the source code <NUM> may be divided into a sentence transformer encoder. For example, the source code analyzer <NUM> may extract, from the source code <NUM>, at least one remediated section <NUM>. For <FIG>, as shown at <NUM>, the remediated section is dbConnection. preparedStatement (previously it was dbConnection. statement). The source code analyzer <NUM> may identify, from the extracted at least one remediated section <NUM>, each sentence of the at least one remediated section <NUM>. As shown at <NUM>, the source code <NUM> may be divided line-by-line and placed into a KNN space. For example, the cluster generator <NUM> may generate, based on an analysis of each identified sentence <NUM> of the at least one remediated section <NUM>, the plurality of clusters <NUM>.

With respect to operation of the auxiliary dataset generator <NUM>, the threshold <NUM> may be defined to segregate the score. The threshold <NUM> may be specified as a constant, and may be adjusted as needed based on the need of the dataset.

Once the threshold <NUM> is specified, the auxiliary dataset generator <NUM> may determine, for each identified sentence of the specified cluster of the plurality of clusters <NUM>, whether the score <NUM> is greater than a specified threshold <NUM>. The auxiliary dataset generator <NUM> may designate each identified sentence of the specified cluster of the plurality of clusters <NUM> for which the score <NUM> is greater than the specified threshold <NUM> as a relevant sentence. The auxiliary dataset generator <NUM> may generate, based on a plurality of relevant sentences <NUM>, the auxiliary dataset <NUM> that includes at least one relevant vulnerability and at least one relevant remediation that remediates the at least one relevant vulnerability. In this regard, with respect to the auxiliary dataset <NUM>, for a sentence that has a score greater than the threshold <NUM>, the sentence may be identified as "action" and marked as "DO_NOTHING". The "DO_NOTHING" action may mean frequent data, and based on the aforementioned assumptions, frequent data may represent relevant data (e.g., vulnerable and remediated data).

For a sentence that has a score that is less than or equal to the threshold <NUM>, the sentence may marked as "DELETE".

<FIG> illustrates auxiliary dataset creation to illustrate operation of apparatus <NUM>, in accordance with an example of the present disclosure.

Referring to <FIG> and <FIG>, assuming that the threshold is <NUM>, cluster <NUM> may represent Space A that includes <NUM> sentences, with top K neighbors including <NUM> sentences that include a score greater than the threshold. Cluster <NUM> may represent Space B that includes <NUM> sentences, where a number of items in space B is less than the top K. In order to generate the auxiliary dataset <NUM>, an analysis of all of the sentences may be performed as follows: if result_score > threshold: return <NUM> or return <NUM>.

Once the auxiliary dataset <NUM> is generated, the further auxiliary dataset generator <NUM> may utilize a Convolutional Neural Network (CNN) model (e.g., the auxiliary dataset generation machine learning model <NUM>) for classification from the auxiliary dataset <NUM>.

Hyper parameters for the CNN model (e.g., the auxiliary dataset generation machine learning model <NUM>) may be specified as follows.

Hyper parameter embedding_dim for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, an embedding is a relatively low-dimensional space into which high-dimensional vectors may be translated. Embeddings may make it easier to perform machine learning on large inputs such as sparse vectors representing words.

Hyper parameter seq_length for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, a sequence length may represent the length of the sequence of input data.

Hyper parameter num_classes for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, a number of possible outputs may be either <NUM> or <NUM>.

Hyper parameter kernel_size for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, kernel_size may represent the size of the convolutional filter.

Hyper parameter vocab_size for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, vocab_size may represent the size of the vocabulary.

Hyper parameter hidden_dim for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, a hidden dimension may refer to the hidden network between the input and the output layers.

Hyper parameter dropout_keep_prob for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, a term "dropout" may refer to dropping out of the nodes (e.g., input and hidden layer) in a neural network. All of the forward and backwards connections with a dropped node may be temporarily removed, thus creating a new network architecture out of the parent network. The nodes may be dropped by a dropout probability of p, where the probability during the training of the model may be specified as <NUM>.

Hyper parameter learning_rate for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as 1e-<NUM>. In this regard, a learning rate may represent the hyperparameter in optimization algorithms that controls how much the model needs to change in response to the estimated error for each time when the model's weights are updated. The learning rate may determine the frequency of cross-checking with model parameters. With respect to selection of the optimized learning rate, if the learning rate is relatively less, such a rate may slow down the training process. Alternatively, if the learning rate is relatively large, such a rate may not optimize the model properly.

Hyper parameter batch_size for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, with respect to batch size, in order to enhance the speed of the learning process, the training set may be divided into different subsets denoted as a batch.

Hyper parameter num_epochs for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, with respect to a number of epochs, an epoch may be defined as the complete cycle for training a machine learning model. An epoch may represent an iterative learning process. The number of epochs may vary from model to model, and various models may be created with more than one epoch. In order to determine the correct number of epochs, a validation error may be taken into account. The number of epochs may be increased until there is a reduction in a validation error. If there is no improvement in reduction error for the consecutive epochs, this may be used as an indication to stop increasing the number of epochs.

Hyper parameter print_per_batch for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, print_per_batch may print logs every <NUM> iteration, for example, by printing the loss and the accuracy details.

Hyper parameter save_per_batch for the auxiliary dataset generation machine learning model <NUM> (as well as the source code remediation machine learning model <NUM>) may be specified as <NUM>. In this regard, save_per_batch may save the checkpoint of the model every <NUM> iteration.

<FIG> respectively illustrate an example block diagram <NUM>, a flowchart of an example method <NUM>, and a further example block diagram <NUM> for source code differential pruning-based dataset creation, according to examples. The block diagram <NUM>, the method <NUM>, and the block diagram <NUM> may be implemented on the apparatus <NUM> described above with reference to <FIG> by way of example and not of limitation. The block diagram <NUM>, the method <NUM>, and the block diagram <NUM> may be practiced in other apparatus. In addition to showing the block diagram <NUM>, <FIG> shows hardware of the apparatus <NUM> that may execute the instructions of the block diagram <NUM>. The hardware may include a processor <NUM>, and a memory <NUM> storing machine readable instructions that when executed by the processor cause the processor to perform the instructions of the block diagram <NUM>. The memory <NUM> may represent a non-transitory computer readable medium. <FIG> may represent an example method for source code differential pruning-based dataset creation, and the steps of the method. <FIG> may represent a non-transitory computer readable medium <NUM> having stored thereon machine readable instructions to provide source code differential pruning-based dataset creation according to an example. The machine readable instructions, when executed, cause a processor <NUM> to perform the instructions of the block diagram <NUM> also shown in <FIG>.

The processor <NUM> of <FIG> and/or the processor <NUM> of <FIG> may include a single or multiple processors or other hardware processing circuit, to execute the methods, functions and other processes described herein. These methods, functions and other processes may be embodied as machine readable instructions stored on a computer readable medium, which may be non-transitory (e.g., the non-transitory computer readable medium <NUM> of <FIG>), such as hardware storage devices (e.g., RAM (random access memory), ROM (read only memory), EPROM (erasable, programmable ROM), EEPROM (electrically erasable, programmable ROM), hard drives, and flash memory). The memory <NUM> may include a RAM, where the machine readable instructions and data for a processor may reside during runtime.

Referring to <FIG>, and particularly to the block diagram <NUM> shown in <FIG>, the memory <NUM> may include instructions <NUM> to receive source code <NUM> that includes at least one vulnerability <NUM> and at least one remediation <NUM> that remediates the at least one vulnerability <NUM>.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to extract, from the source code <NUM>, at least one remediated section <NUM>.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to identify, from the extracted at least one remediated section <NUM>, each sentence of the at least one remediated section <NUM>.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to generate, based on an analysis of each identified sentence <NUM> of the at least one remediated section <NUM>, a plurality of clusters <NUM>.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to determine, for each identified sentence of a specified cluster of the plurality of clusters <NUM>, a score <NUM> with respect to the specified cluster that includes the identified sentence.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to determine, for each identified sentence of the specified cluster of the plurality of clusters <NUM>, whether the score <NUM> is greater than a specified threshold <NUM>.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to designate each identified sentence of the specified cluster of the plurality of clusters <NUM> for which the score <NUM> is greater than the specified threshold <NUM> as a relevant sentence.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to generate, based on a plurality of relevant sentences <NUM>, an auxiliary dataset <NUM> that includes at least one relevant vulnerability and at least one relevant remediation that remediates the at least one relevant vulnerability.

Referring to <FIG> and <FIG>, and particularly <FIG>, for the method <NUM>, at block <NUM>, the method may include receiving source code <NUM> that includes at least one vulnerability <NUM> and at least one remediation <NUM> that remediates the at least one vulnerability <NUM>.

At block <NUM>, the method may include generating, based on an analysis of each identified sentence of at least one remediated section <NUM> of the source code <NUM>, a plurality of clusters <NUM>.

At block <NUM>, the method may include determining, from each identified sentence of a specified cluster of the plurality of clusters <NUM>, at least one relevant sentence.

At block <NUM>, the method may include generating, based on a plurality of relevant sentences, an auxiliary dataset <NUM> that includes at least one relevant vulnerability and at least one relevant remediation that remediates the at least one relevant vulnerability.

Referring to <FIG> and <FIG>, and particularly <FIG>, for the block diagram <NUM>, the non-transitory computer readable medium <NUM> may include instructions <NUM> to generate, based on an analysis of each identified sentence of at least one remediated section of source code <NUM> that includes at least one vulnerability <NUM> and at least one remediation <NUM> that remediates the at least one vulnerability, a plurality of clusters <NUM>.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to determine, from each identified sentence of a specified cluster of the plurality of clusters <NUM>, at least one relevant sentence.

The processor <NUM> may fetch, decode, and execute the instructions <NUM> to generate, based on a plurality of relevant sentences, an auxiliary dataset <NUM> that includes at least one relevant vulnerability <NUM> and at least one relevant remediation <NUM> that remediates the at least one relevant vulnerability.

Claim 1:
A source code differential pruning-based dataset creation apparatus (<NUM>) comprising:
a source code analyzer (<NUM>), executed by at least one hardware processor (<NUM>, <NUM>), to:
receive source code (<NUM>) that includes at least one vulnerability (<NUM>) and at least one remediation (<NUM>) that remediates the at least one vulnerability (<NUM>);
extract, from the source code (<NUM>), at least one remediated section (<NUM>); and
identify, from the extracted at least one remediated section (<NUM>), each sentence of the at least one remediated section (<NUM>);
a cluster generator (<NUM>), executed by the at least one hardware processor (<NUM>, <NUM>), to:
generate, based on an analysis of each identified sentence (<NUM>) of the at least one remediated section (<NUM>), a plurality of clusters (<NUM>) in a k-nearest neighbors (KNN) search space; and
determine, for each identified sentence (<NUM>) of a specified cluster of the plurality of clusters (<NUM>), a score (<NUM>), based on a semantic search on the plurality of clusters (<NUM>), with respect to the specified cluster that includes the identified sentence (<NUM>); and
an auxiliary dataset generator (<NUM>), executed by the at least one hardware processor (<NUM>, <NUM>), to:
determine, for each identified sentence (<NUM>) of the specified cluster of the plurality of clusters (<NUM>), whether the score (<NUM>) is greater than a specified threshold (<NUM>);
designate each identified sentence (<NUM>) of the specified cluster of the plurality of clusters (<NUM>) for which the score (<NUM>) is greater than the specified threshold (<NUM>) as a relevant sentence; and
generate, based on a plurality of relevant sentences (<NUM>), an auxiliary dataset (<NUM>) that includes at least one relevant vulnerability and at least one relevant remediation that remediates the at least one relevant vulnerability.