CodeTrust: Predicting Vulnerabilities using Big Code

The ability to verify that software systems can be trusted is of utmost and urgent importance. A critical component of trust is whether software appears to have vulnerabilities that can be exploited. To that end, here we propose CodeTrust, a software system that uses Big Code to identify vulnerabilities in the lines of code themselves, using machine learning, pattern identification, and 3rd party software analysis, along with vulnerabilities introduced by software engineering practices such as submitting huge changes to the code at once, or relying on more inexperienced developers for critical components. Our ensemble method can then take as input a code base and predict if there are vulnerabilities and why that might be the case.