Qwiet AI Builds a Neural Net to Catch Coding Vulnerabilities

RSA CONFERENCE 2023 – San Francisco – Application security company Qwiet AI has announced a new threat intelligence feed for its real-time code security analysis tool PreZero to help security teams focus on remediating the fixes that will have the most impact on application security.

The data feed, called Blacklight, analyzes information about exploits that are deployed in the wild. Developers can use the data to see which vulnerabilities to address right away and which ones can wait. Just like a physical black light can reveal where that smell is coming from, Blacklight “exposes what you can’t see visually,” says Qwiet AI CEO Stuart McClure.

Narrowing the scope of patching is vital, considering the sheer volume of vulnerabilities reported. There were 3,239 high-severity vulnerabilities found in 2022, according to NIST’s National Vulnerability Database, putting security teams in the position of having to remediate about 10 a day, every calendar day, to fix just the most serious vulnerabilities. But past research has shown that not all vulnerabilities need to be fixed right away. Only 15% of vulnerabilities get loaded into memory, which suggests 85% aren’t reachable by an attacker, according to Sysdig. And of those reachable vulnerabilities, even less are exploitable in practice. In 2022 Qwiet AI, then called ShiftLeft, announced that only 3% of open source vulnerabilities were attackable.

The trick, of course, lies in identifying the 3%. PreZero asks a series of questions to whittle down vulnerabilities to a shorter list of those requiring immediate action: Does the application load the package containing the CVE? Is that package in use by the application? Can an attacker reach that package? And how can the developer mitigate the vulnerability?

A survey of PreZero users found that the new threat feed reduces the average cost per finding by nearly 25%, according to the company.

Putting Artificial Narrow Intelligence to Work

PreZero builds a deep neural net out of code property graphs (CPGs), which analyze JavaScript — 58 billion lines of it so far, according to McClure. The CPG is made up of three kinds of data graphs: abstract syntax trees that classify code according to syntax, data flow graphs that map variables from input through to the outputs to see how the data changes, and control flow graphs that track who controls the data and what changes are made.

The artificial narrow intelligence system uses those CPGs to build a model of what good code looks like versus vulnerable code, which it then can apply to new code that’s entered into the tool.

“We’re gonna go through the typical path, which is the code property graph based on these human-written policies, but we’re also going to send that same code sample through our AI model and be able to determine if there’s an additional vulnerability in there that the humans didn’t catch or the signatures didn’t catch,” McClure says. “And so that’s what really differentiates us.”

Qwiet AI shared with Dark Reading a screenshot of a report Blacklight generated on Log4j 2.9.1, one of many versions of the logging utility affected by the Log4Shell vulnerability, to demonstrate the kind of information the feed provides. Potentially the most useful section is remediation advice, which counsels, “Users who want to avoid attacker-controlled JNDI lookups but cannot upgrade to 2.16.0 must ensure that no such lookups resolve to attacker-provided data and ensure that the JndiLookup class is not loaded.”

“I’ve spent my time in the trenches,” says Bruce Snell, Qwiet AI director of technical and product marketing. “There’s something more visceral about attaching an actual exploit or a threat actor to a vulnerability.”

Another interesting feature in PreZero is security insights, which flags code that would open the door to vulnerabilities if it were deployed. That’s clearly useful for developers trying to write more secure code, but McClure says the security side also benefits from PreZero.

“The AppSec, cybersecurity, and CISOs would use [PreZero] to understand the current state of risk to the business, but then developers use it to actually get the line of code that they need to go fix,” he says.

AI Is Good Business

Competition does abound. For example, Snyk uses AI in vulnerability scanning, as does GitHub — although the Spider Artificial Intelligence Vulnerability Scanner (SAIVS) falls into the machine learning category.

“We’ve had this skill shortage for as long as I can remember now, and I think it’s actually worse on the AppSec side than it is in the InfoSec side,” Snell says. “So having this AI that can, instead of trying to find the needle in a haystack, just produce a stack of needles and say, ‘Here’s the things that you need to deal with’ is going to be huge. And it’s really going to be the only way I think that the industry can keep up.”

Getting away from signatures is something McClure has been working on since he co-founded Cylance, which he sold to BlackBerry for $1.4 billion in 2018; he’s been planning out his vision of the future of AI since at least 2016. To demonstrate his hacking philosophy in action, McClure is co-presenting a technical session “Hacking Exposed — Hacking the Sec into DevOps” with Qwiet AI CTO Chetan Conikee on Wednesday April 26 at 1:15 p.m.