{"id":90903,"date":"2020-04-16T09:00:04","date_gmt":"2020-04-16T16:00:04","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=90903"},"modified":"2023-05-15T23:28:18","modified_gmt":"2023-05-16T06:28:18","slug":"secure-software-development-lifecycle-machine-learning","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2020\/04\/16\/secure-software-development-lifecycle-machine-learning\/","title":{"rendered":"Secure the software development lifecycle with machine learning"},"content":{"rendered":"
Every day, software developers stare down a long list of features and bugs that need to be addressed. Security professionals try to help by using automated tools to prioritize security bugs, but too often, engineers waste time on false positives or miss a critical security vulnerability that has been misclassified. To tackle this problem data science and security teams came together to explore how machine learning could help. We discovered that by pairing machine learning models with security experts, we can significantly improve the identification and classification of security bugs.<\/p>\n
At Microsoft, 47,000 developers generate nearly 30 thousand bugs a month. These items get stored across over 100 AzureDevOps and GitHub repositories. To better label and prioritize bugs at that scale, we couldn\u2019t just apply more people to the problem. However, large volumes of semi-curated data are perfect for machine learning. Since 2001 Microsoft has collected 13 million work items and bugs. We used that data to develop a process and machine learning model that correctly distinguishes between security and non-security bugs 99 percent of the time and accurately identifies the critical, high priority security bugs, 97 percent of the time. This is an overview of how we did it.<\/p>\n
Our goal was to build a machine learning system that classifies bugs as security\/non-security and critical\/non-critical with a level of accuracy that is as close as possible to that of a security expert. To accomplish this, we needed a high-volume of good data. In supervised learning, machine learning models learn how to classify data from pre-labeled data. We planned to feed our model lots of bugs that are labeled security and others that aren\u2019t labeled security. Once the model was trained, it would be able to use what it learned to label data that was not pre-classified. To confirm that we had the right data to effectively train the model, we answered four questions:<\/p>\n
Our evaluation gave us confidence that we had enough good data to design the process and build the model.<\/p>\n
Our classification system needs to perform like a security expert, which means the subject matter expert is as important to the process as the data scientist. To meet our goal, security experts approved training data before we fed it to the machine learning model. We used statistical sampling to provide the security experts a manageable amount of data to review. Once the model was working, we brought the security experts back in to evaluate the model in production.<\/p>\n
With a process defined, we could design the model. To classify bugs accurately, we used a two-step machine learning model operation. First the model learned how to classify security and non-security bugs. In the second step the model applied severity labels\u2014critical, important, low-impact\u2014to the security bugs.<\/p>\n
Building an accurate model is an iterative process that requires strong collaboration between subject matter experts and data scientists:<\/p>\n
Data collection: <\/strong>The project starts with data science. We identify all the data types and sources and evaluate its quality.<\/p>\n Data curation and approval:<\/strong>\u00a0Once the data scientist has identified viable data, the security expert reviews the data and confirms the labels are correct.<\/p>\n Modeling and evaluation: <\/strong>Data scientists select a data modeling technique, train the model, and evaluate model performance.<\/p>\n Evaluation of model in production:<\/strong> Security experts evaluate the model in production by monitoring the average number of bugs and manually reviewing a random sampling of bugs.<\/p>\n The process didn\u2019t end once we had a model that worked. To make sure our bug modeling system keeps pace with the ever-evolving products at Microsoft, we conduct automated re-training. The data is still approved by a security expert before the model is retrained, and we continuously monitor the number of bugs generated in production.<\/p>\n By applying machine learning to our data, we accurately classify which work items are security bugs 99 percent of the time. The model is also 97 percent accurate at labeling critical and non-critical security bugs. This level of accuracy gives us confidence that we are catching more security vulnerabilities before they are exploited.<\/p>\n In the coming months, we will open source our methodology to GitHub.<\/p>\n In the meantime, you can read a published academic paper, Identifying security bug reports based solely on report titles and noisy data<\/a>, for more details.<\/p>\n Bookmark the\u00a0Security blog<\/a>\u00a0to keep up with our expert coverage on security matters. Also, follow us at\u00a0@MSFTSecurity<\/a> for the latest news and updates on cybersecurity. To learn more about our Security solutions visit our website<\/a>.<\/p>\n \n Hear more from the author of this blog on episode #16 of Security Unlocked. Subscribe for new episodes each week covering the latest in security news.<\/p>\n\t\t\t\t\t<\/div>\n\n\t\t\t\t\t\t\t\t\t\t\tMore to come<\/h3>\n
Listen to the Security Unlocked podcast<\/h2>\n\n\t\t\t\t\t