RU2821220C1 - Method and system for eliminating vulnerabilities in program code - Google Patents

Abstract

FIELD: physics.

SUBSTANCE: invention relates to computer engineering. Computer-implemented method of eliminating vulnerabilities in a program code, carried out using at least one processor and comprising steps of: obtaining data on vulnerabilities in program code; obtaining data containing at least a source code unit and a type of detected vulnerability; source code containing the vulnerability is transformed into an abstract syntax tree (AST), where internal vertices are associated with programming language operators, and leaves with corresponding operands; forming a path for bypassing vertices in the AST; generating an ordered sequence and processing it using a machine learning coding model; method includes processing a matrix of hidden sequences using a generative machine learning model trained on matrices of hidden states of sequences for vulnerabilities, during which a new ordered sequence is obtained, corresponding to the source program code, but with the vulnerability eliminated; ordered sequence obtained at the previous step is converted into a source code block.

EFFECT: higher security of software due to elimination of vulnerabilities in program code.

8 cl, 2 dwg

Description

TECHNICAL FIELD

[0001] The claimed technical solution generally relates to the field of computer technology, and in particular to an automated method and system for eliminating vulnerabilities in program code using machine learning algorithms.

BACKGROUND OF THE ART

[0002] With the development of information technology, IT solutions (information technology) began to have a significant impact on all spheres and sectors of life. Currently, various companies and organizations are actively implementing and using IT solutions in their structure.

[0003] Software development for large financial organizations (for example, banks) is always labor-intensive and painstaking work. In addition, when developing a software product, it is necessary to take into account all the risks of vulnerabilities in the program code. For these checks, cybersecurity experts are involved, who manually check for vulnerabilities in the software code of the product being developed, which greatly increases the verification time and also does not exclude the human factor.

[0004] Patent US 8631384 B2 "Creating a test progression plan" is known from the prior art, patent holder: IBM, publ. 01.12.2011. This solution describes the automated process of drawing up test plans for software products. The known solution provides automatic creation of a software test execution plan by calculating for each unit of the testing period x the effort to execute the ATx test blocks and the effort to complete the execution of the CCx test block. The calculation introduces three variables that characterize the testing strategy: efficiency, which represents the effectiveness of the test group, the defect density ratio, and the value of the inspection ratio. When choosing a test strategy, the test manager determines the values of three variables that influence the development plan. During test execution, the cumulative "attempt" curve of ATx values and the cumulative "completion" curve of CCx values allow the test manager to compare the effort already made with the expected effort taken for test units that were attempted and for test units that were completed, i.e. when defects found in the code have been fixed.

[0005] A disadvantage of known solutions in this field of technology is the lack of the ability to automatically eliminate vulnerabilities in program code.

DISCLOSURE OF INVENTION

[0006] The claimed technical solution proposes a new approach to eliminating vulnerabilities in program code. This solution uses a machine learning algorithm that automates the process of checking program code and significantly speeds up the process of eliminating vulnerabilities in program code.

[0007] Thus, the technical problem of automated elimination of vulnerabilities in program code is solved.

[0008] The technical result achieved by solving this problem is to increase software security by eliminating vulnerabilities in the program code.

[0009] The specified technical result is achieved through the implementation of a computer-implemented method for eliminating vulnerabilities in program code, executed using at least one processor and containing stages in which:

- receive data on vulnerabilities in the program code;

- obtain, based on the previous stage, data containing at least a block of source code and the type of vulnerability detected;

- convert the source code containing the vulnerability into an abstract syntax tree (AST), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands;

- form a path to traverse the vertices in AST;

- form an ordered sequence that represents the types of each element of the path;

- process the ordered sequence using a machine learning encoding model trained on ordered sequences of vulnerability data, during which a representation of the ordered sequence is obtained in the form of a matrix of hidden states;

- process the matrix of hidden sequences using a generative machine learning model trained on matrices of hidden states of sequences for vulnerabilities, sequences without vulnerabilities and their source codes, during which a new ordered sequence is obtained that corresponds to the source program code for the functions performed, but with the functions eliminated without vulnerability;

- translate the ordered sequence obtained at the previous stage into a source code block that is functionally equivalent to the original source code block.

[0010] In one of the particular embodiments of the method, the ordered sequence, which represents the types of each element of the path, is multidimensional and represents a graph.

[0011] In another particular embodiment of the method, the source code containing the vulnerability is converted into a control flow graph (CFG) in which internal vertices are mapped to programming language operators, and leaves are mapped to the corresponding operands.

[0012] In another particular embodiment of the method, the source code containing the vulnerability is converted into a control dependency graph (CDG - Control Dependence Graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands.

[0013] In another particular embodiment of the method, the source code containing the vulnerability is converted into a data dependency graph (DDG - Data Dependence Graph), in which internal vertices are mapped to programming language operators, and leaves are mapped to the corresponding operands.

[0014] In another particular embodiment of the method, the source code containing the vulnerability is converted into a program dependency graph (PDG - Program Dependence graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands.

[0015] In another particular embodiment of the method, the source code containing the vulnerability is converted into a code property graph (CPG - Code Property Graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands.

[0016] In addition, the claimed technical result is achieved through a system for eliminating vulnerabilities in program code, containing:

- at least one processor;

- at least one memory connected to the processor, which contains machine-readable instructions that, when executed by at least one processor, ensure the execution of the claimed method.

BRIEF DESCRIPTION OF THE DRAWINGS

[0017] FIG. 1 illustrates a block diagram of the claimed method.

[0018] FIG. 2 illustrates an example of a general view of a computing system that ensures the implementation of the claimed solution.

IMPLEMENTATION OF THE INVENTION

[0001] The concepts and terms necessary to understand this technical solution will be described below.

[0002] A model in machine learning (ML) is a set of artificial intelligence methods, the characteristic feature of which is not the direct solution of a problem, but learning in the process of applying solutions to many similar problems.

[0003] A software vulnerability is a flaw in a system that, when exploited, can intentionally compromise its integrity and cause incorrect operation. Vulnerabilities can be the result of programming errors, flaws in system design, weak passwords, viruses and other malware, script and SQL injections. Vulnerabilities can be unexploitable or exploitable.

[0004] Exploit - a computer program, a piece of program code or a sequence of commands that takes advantage of vulnerabilities in software and is used to carry out an attack on a computer system.

[0005] An exploitable vulnerability is a vulnerability in software for which an exploit can be created and applied.

[0006] AST is an abstract syntax tree. A finite labeled directed tree in which the internal vertices are associated with programming language operators and the leaves are associated with corresponding operands.

[0007] The F-1 measure is a joint assessment of precision and recall.

[0008] ROC curve is a graphical characteristic of the quality of a binary classifier, reflecting the dependence of the proportion of true-positive classifications on the proportion of false-positive classifications when varying the threshold of the decision rule.

[0009] An error matrix is a way to break classifiable objects into four categories depending on the combination of the actual class and the classifier response.

[0010] Connectors are software components that collect data from information sources (task management system / release collaboration system / version control system / project management system / enterprise service management system / etc.) and bring the data to the necessary structure and format.

[0011] Storage - a system for storing large volumes of data collected and processed by connectors, as well as data generated by other system components.

[0012] This technical solution can be implemented on a computer, in the form of an automated information system (AIS) or a machine-readable medium containing instructions for performing the above method.

[0013] The technical solution can be implemented in the form of a distributed computer system.

[0014] In this solution, a system means a computer system, a computer (computer), CNC (computer numerical control), PLC (programmable logic controller), computerized control systems and any other devices capable of performing a given, well-defined sequence of computing operations (actions, instructions).

[0015] A command processing device means an electronic unit or an integrated circuit (microprocessor) that executes machine instructions (programs)/

[0016] A command processing device reads and executes machine instructions (programs) from one or more data storage devices, such as devices such as random access memory (RAM) and/or read only memory (ROM). ROM can be, but is not limited to, hard drives (HDD), flash memory, solid-state drives (SSD), optical storage media (CD, DVD, BD, MD, etc.), etc.

[0017] Program - a sequence of instructions intended for execution by a computer control device or command processing device.

[0018] Preparing training data.

[0019] The model was trained on historical data on software vulnerabilities, divided into 2 classes:

code with vulnerability (class 1),

code without vulnerability (class 0).

[0020] The ML model for each type of vulnerability is trained on pre-labeled data. In total, at the time of creation of the model, from 2178 to 55949 vulnerabilities were available, depending on the type of vulnerability, discovered in a given time range, for example, 1-3 months.

[0021] The training set used exclusively unique vulnerabilities, the number of which varies from 153 to 2147 depending on the type of vulnerability. To assess the quality of the model, the data set was divided into 2 parts: training and control samples. The split occurred randomly with a ratio of 70% to the training set and 30% to the control set.

[0022] The weighted f-1 measure for all classifiers averages about 0.89.

[0023] As shown in FIG. 1, a computer-implemented method for addressing vulnerabilities in software code (100) consists of several steps performed by at least one processor.

[0024] At step (101), data about vulnerabilities in the program code is obtained.

[0025] At this stage, data on vulnerabilities is obtained. In one of the private embodiments of the invention, this data is obtained as a result of scanning program code using the SAST (Static Application Security Testing) tool.

[0026] Next, at step (102), based on the previous step, data containing at least a source code file and the type of vulnerability detected is obtained.

[0027] Next, at step (103), the source code containing the vulnerability is converted into an abstract syntax tree (AST), in which internal nodes are mapped to programming language operators and leaves to corresponding operands.

[0028] At this stage, syntactic analysis (parsing) of the source code contained in the file obtained at Stage (103) and written in any programming language (Java, C#, ASP, Visual Basic, C, C++, PHP) is performed , Apex, Ruby, JavaScript, VBScript, Perl, Swift, Python, Groovy, Scala, etc.), the result of which is a parse tree or abstract syntax tree that displays the dependencies between all elements of the source code, containing information about their positions in the source code ( line number of the beginning of the element, column number of the beginning of the element, line number of the end of the element, column number of the end of the element), their classes, such as expressions, statements, declarations, etc., types of their classes, their names , their parent and inherited elements, comments to them, etc.

[0029] In one of the particular embodiments of the claimed technical solution, the source code containing the vulnerability is converted into a control flow graph (CFG - control flow graph), in which internal vertices are mapped to programming language operators, and leaves are mapped to the corresponding operands.

[0030] In another particular embodiment of the claimed technical solution, the source code containing the vulnerability is converted into a control dependency graph (CDG - Control Dependence Graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands.

[0031] In another particular embodiment of the claimed technical solution, the source code containing the vulnerability is converted into a data dependency graph (DDG - Data Dependence Graph), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands.

[0032] In another particular embodiment of the claimed technical solution, the source code containing the vulnerability is converted into a program dependency graph (PDG - Program Dependence graphs), in which internal vertices are mapped to programming language operators, and leaves are mapped to the corresponding operands.

[0033] In another particular embodiment of the claimed technical solution, the source code containing the vulnerability is converted into a code property graph (CPG - Code Property Graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands.

[0034] Next, at step (104), a path to traverse the AST vertices is formed.

[0035] Next, at step (105), an ordered sequence is generated that represents the types of each element.

[0036] At this stage, from the vertex traversal path in the AST generated in step (105), in which each element contains the information obtained in step (104), an ordered sequence of element class types (vertex types) of this path is formed.

[0037] In one particular embodiment of the invention, the ordered sequence representing the types of each path element is multidimensional and is a graph (an abstract syntax tree (AST) representation as a graph).

[0038] Next, at step (106), the ordered sequence is processed using a machine learning (ML) encoding model trained on the ordered sequences of vulnerability data, during which a representation of the ordered sequence in the form of a matrix of hidden states is obtained.

[0039] At this stage, a dictionary of all possible types of classes (types) of AST vertices obtained at Stage (103) is formed. The values of this dictionary for each sequence generated at step (105) will be the number of corresponding types present in this sequence and/or N-grams of such types. From the values of such a dictionary, a numerical vector with the same dimension is formed for all sequences using at least one of the methods:

• Bag-of-words,

• One-hot encoding (ONE),

• Encoding the dictionary with unique indexes,

• Word2Vec,

• Vector representations of types - “Embedding” and/or their combinations.

[0040] To obtain Embedding types, technologies such as neural networks can be used: Fully Connected, Recurrent, Convolutional, Transformers. In one of the particular embodiments of the invention, pre-trained neural networks are used to obtain vector representations of types, such as DistilBERT: smaller, faster, cheaper, lighter; ALBERT (Lite BERT Google); TinyBERT; T-NLG (Turing Natural Language Generation); USE (Universal Sentence Encoder); ELMo (Embeddings from Language Models) or networks inherited from them.

[0041] Vectorization

To extract features from the generated dictionaries, the TF-IDF (term-frequency times inverse document-frequency) vectorization method was used. The vectorizer was trained on a training sample without using stop words (stop_words=None), without using IDF, since, based on the size of the training sample and the presence of very common features in each element of the training sample, the IDF component will not allow calculating special features for each dictionary , 1 and 2 grams were used (the parameter was selected experimentally).

[0042] Training a machine learning model

To obtain a matrix of hidden sequences, an encoder (encoding) block of a generative machine learning model is used. This block can be an Embedding layer, randomly trained or initialized. Next can be neural networks: Fully connected, Recurrent, Convolutional, Transformers. In one of the particular embodiments of the invention, the encoder block represents at least one layer of neural networks from the types Recurrent neural networks (RNN), Long short term memory (LSTM), Controlled recurrent neurons (Gated recurrent units, GRU), Neural Turing machines (NMT), Bidirectional RNNs, LSTM and GRU (BiRNN, BiLSTM and BiGRU), Deep residual networks (DRN), Echo state networks (ESN) , Liquid state machines (LSM), self-organizing Kohonen networks (KN, or organizing (feature) map, SOM, SOFM).

[0043] Next, at step (107), the matrix of hidden sequences is processed using a generative machine learning (ML) model trained on the matrices of hidden states of sequences for vulnerabilities, sequences without vulnerabilities and their source codes, during which a new ordered sequence corresponding to the source program code according to the functions performed, but with the vulnerability eliminated in it.

[0044] This processing is carried out by the generator (decoder) block of the generative machine learning model. This block can be a decoder such as Variational Autoencoder (VAE), Deep Learning Methods, Restricted Boltzmann Machine (RBM), Deep Belief Network (DBN), neural networks: Fully Connected, Recurrent, Convolutional, Transformers.

[0045] In one of the particular embodiments of the invention, the decoder block represents at least one layer of neural networks from the types Convolutional neural networks (CNN), Recurrent neural networks (RNN), Long short term memory (LSTM) ), Gated recurrent units (GRU), Neural Turing machines (NMT), Bidirectional RNNs, LSTM and GRU (BiRNN, BiLSTM and BiGRU), Deep residual networks (DRN), Neural echo networks (Echo state networks (ESN), Liquid state machines (LSM), self-organizing Kohonen networks (KN, or organizing (feature) map, SOM, SOFM).

[0046] In one of the particular embodiments of the invention, Generative adversarial networks (abbr. GAN) are used as a machine learning model. This generative adversarial network may contain an encoder block with the layers specified in the section above. May contain a decoder block with the layers specified in the section above. The discriminator block (discriminant model) in one of the particular embodiments of the invention contains neural networks: Fully connected, Recurrent, Convolutional, Transformers; Classifiers: DecisionTree (decision tree), LogRegression (logistic regression), Bayes (Naive Bayes classifier), SVM (support vector machine), K-means (k-neighbors), RandomForest (random forest), gradient boosting: XGBoost, LightGBM.

[0047] Training occurs as follows: operations are performed on two groups of program code blocks, where the first program code blocks are code with a vulnerability, and the second program code blocks are code without a vulnerability. These blocks are translated into an ordered sequence of AST tree elements in accordance with steps (101)-(106).

[0048] Next, a code sequence with vulnerability - A, and a corresponding code sequence without vulnerability - B are obtained. The resulting sequence A (code with vulnerability) is fed into the encoder (encoding) block of the generative machine learning model. A matrix of hidden states (107) is obtained. This matrix of hidden states is supplied to the generator (decoder) block of the generative machine learning model (108). A new (restored) ordered sequence is obtained - B. This sequence (B) is compared with the original sequence B (code without vulnerability). The resulting discrepancies are recalculated into a quantitative characteristic using the selected loss function. This quantitative characteristic is used to train a neural network using the selected learning algorithm.

[0049] In one particular embodiment of the invention, at least one of the loss functions is used: KLD (Computes the loss of Kullbeck-Leibler divergence between the true value and the predicted value), MAE (Computes the average absolute error between labels and predictions), MAPE (Computes the average absolute percentage error between the true value and the predicted value), MSE (Calculate the mean square error between labels and predictions), MSLE (Calculate the mean square log error between the true value and the predicted value), binary_crossentropy (Calculate the binary crossentropy loss), binary_focal_crossentropy (Calculate the binary focal loss crossentropy), categoricalcrossentropy (Calculate the categorical crossentropy loss), categorical_hinge (Calculate the categorical lasso loss between the true value and the predicted value), cosinesimilarity (Calculate the cosine similarity between labels and predictions), hinge (Calculate the hinge loss between the true value and the predicted value ), huber (Calculate the magnitude of the Huber loss), kl_divergence (Calculate the Kullback-Leibler divergence loss between the true value and the predicted value), kullback_leibler divergence (Calculate the Kullback-Leibler divergence loss between the true value and the predicted value), logcosh (Logarithm of the hyperbolic cosine of the error prediction), logcosh (Logarithm of the hyperbolic cosine of the prediction error), mean_absolute_error (Calculates the mean absolute error between labels and predictions), mean_absolute_percentage_error (Calculates the mean absolute percentage error between the true value and the predicted value), mean_squared_error (Calculates the mean squared error between labels and predictions), mean_squared_logarithmic_error (Calculate the mean squared logarithmic error between the true value and the predicted value), poisson (Calculate the Poisson loss between the true value and the predicted value), sparse_categorical_crossentropy (Calculate the sparse categorical crossentropy loss), squared_hinge (Calculate the squared lasso loss between the true value and the predicted value value). These loss functions often have the following notations: binary_cross_entropy, binary_cross_entropy_with_logits, poisson_nll_loss, cosine_embedding_loss, cross_entropy, ctc_loss, gaussian_nl_loss, hingee_mbedding_loss, kl_div, Il_loss, mse_loss, margin_ranking_loss, multilabel_margin_loss, multilabel_soft_margin_ loss, multirnargin_loss, nll_loss, huber_loss, smooth_Il_loss, soft_margin_loss, triplet_margin_loss, triplet_margin_with_distance_loss.

[0050] In one of the private embodiments of the invention, at least one of the learning algorithms is used: Adadelta, Adagrad, Adam, AdamW, SparseAdam, Adamax, ASGD, LBFGS, NAdam, RAdam, RMSprop, Rprop, FTRL, SGD, FastSGD, SGD- Nesterov, SAGA, SAGA+.

[0051] Next, at step (108), the ordered sequence obtained at the previous step is translated into a source code block that is functionally equivalent to the original source code block.

[0052] As a result, this approach allows you to formulate and prioritize tasks to eliminate deficiencies in the software being developed, thereby increasing the speed of program code development, reduces the number of errors in the program code, and also directly affects the security of the program code, which ensures an increase in the update rate software or bringing software to market by eliminating vulnerabilities and increasing the reliability of software from malicious actions aimed at:

• Theft of sensitive information,

• Causing reputational or financial damage to an organization or user,

• Destroying important data or preventing access to important data,

• Distortion of information,

• Theft of funds.

[0053] In FIG. 2 shows an example of a general view of a computing system (300), which implements the claimed method or is part of a computer system, for example, a server, a personal computer, or part of a computing cluster that processes the necessary data to implement the claimed technical solution.

[0054] In general, the system (300) contains one or more processors (301), memory devices such as RAM (302) and ROM (303), input/output interfaces (304), and input devices connected by a common information exchange bus. /output (1105), and a device for network communication (306).

[0055] The processor (301) (or multiple processors, multi-core processor, etc.) may be selected from a variety of devices commonly used today, for example, from manufacturers such as: Intel™, AMD™, Apple™, Samsung Exynos ™, MediaTEK™, Qualcomm Snapdragon™, etc. Under the processor or one of the processors used in the system (300), it is also necessary to take into account the graphics processor, for example, NVIDIA GPU or Graphcore, the type of which is also suitable for carrying out the method in whole or in part, and can also be used to train and apply machine learning models in various information systems.

[0056] RAM (302) is a random access memory and is designed to store computer-readable instructions executable by the processor (301) to perform the necessary logical data processing operations. The RAM (302) typically contains executable operating system instructions and associated software components (applications, program modules, etc.). In this case, the available memory capacity of the graphics card or graphics processor can act as RAM (302).

[0057] The ROM (303) is one or more permanent storage devices, such as a hard disk drive (HDD), a solid state drive (SSD), flash memory (EEPROM, NAND, etc.), optical storage media ( CD-R/RW, DVD-R/RW, BlueRay Disc, MD), etc.

[0058] To organize the operation of system components (300) and organize the operation of external connected devices, various types of I/O interfaces (304) are used. The choice of appropriate interfaces depends on the specific design of the computing device, which can be, but is not limited to: PCI, AGP, PS/2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS/Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[0059] To ensure user interaction with the computing system (300), various means (305) of I/O information are used, for example, a keyboard, a display (monitor), a touch display, a touch pad, a joystick, a mouse, a light pen, a stylus, touch panel, trackball, speakers, microphone, augmented reality tools, optical sensors, tablet, light indicators, projector, camera, biometric identification tools (retina scanner, fingerprint scanner, voice recognition module), etc.

[0060] The network communication means (306) provides data transmission via an internal or external computer network, for example, an Intranet, the Internet, a LAN, etc. One or more means (306) may be used, but not limited to: Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and/or BLE module, Wi-Fi module and etc.

[0061] The submitted application materials disclose preferred examples of implementation of a technical solution and should not be interpreted as limiting other, particular examples of its implementation that do not go beyond the scope of the requested legal protection, which are obvious to specialists in the relevant field of technology.

Claims (16)

1. A computer-implemented method for eliminating vulnerabilities in program code, performed using at least one processor and containing the steps of: - receive data on vulnerabilities in the program code; - obtain, based on the previous stage, data containing at least a block of source code and the type of vulnerability detected; - transform the source code containing the vulnerability into an abstract syntax tree (AST), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands; - form a path to traverse the vertices in AST; - form an ordered sequence that represents the types of each element of the path; - process the ordered sequence using a machine learning encoding model trained on ordered sequences of vulnerability data, during which a representation of the ordered sequence is obtained in the form of a matrix of hidden states; - process the matrix of hidden sequences using a generative machine learning model trained on matrices of hidden states of sequences for vulnerabilities, sequences without vulnerabilities and their source codes, during which a new ordered sequence is obtained that corresponds to the source program code for the functions performed, but with the functions eliminated without vulnerability; - translate the ordered sequence obtained at the previous stage into a source code block that is functionally equivalent to the original source code block. 2. The method according to claim 1, characterized in that the ordered sequence, which represents the types of each element of the path, is multidimensional and represents a graph. 3. The method according to claim 1, characterized in that the source code containing the vulnerability is converted into a control flow graph (CFG - control flow graph), in which internal vertices are associated with programming language operators, and leaves with the corresponding operands. 4. The method according to claim 1, characterized by converting the source code containing the vulnerability into a control dependency graph (CDG - Control Dependence Graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands. 5. The method according to claim 1, characterized in that the source code containing the vulnerability is converted into a data dependency graph (DDG - Data Dependence Graph), in which internal vertices are associated with programming language operators, and leaves with the corresponding operands. 6. The method according to claim 1, characterized by converting the source code containing the vulnerability into a program dependency graph (PDG - Program Dependence graphs), in which internal vertices are mapped to programming language operators, and leaves to the corresponding operands. 7. The method according to claim 1, characterized in that the source code containing the vulnerability is converted into a code property graph (CPG - Code Property Graphs), in which internal vertices are associated with programming language operators, and leaves with the corresponding operands. 8. A system for eliminating vulnerabilities in program code, containing at least one processor and memory storing machine-readable instructions, which, when executed by the processor, implement the method according to any one of claims. 1-7.