Internship: Analyzing Advanced Code Representations

**We help the world run better** **What you´ll do** This internship is based in the SAP Labs France Research Lab, in Sophia-Antipolis. The work will be performed in the context of the Research Program “SAP Security Research”, under the “Intelligent Code Analysis” topic. This topic aims at using state-of-the-art machine learning techniques to analyze code make it more secure by spotting vulnerabilities. The vulnerability management process of a software with open source components is challenging due its dependence on non-reliable standard sources of advisories and vulnerability data. Previous efforts aimed to reduce this dependency by directly analyzing source code for the automatic detection of commits that are security-relevant. In [1], source code changes were treated as documents in natural language processing, potentially ignoring the structured nature of source code. The work in [4] incorporated structural information of code in the form of abstract syntax trees (ASTs) as proposed by [2]. Now, we seek to incorporate richer code representations into our analysis, e.g. obtained from semantic representations as well as data and control flow graphs [3]. The goal of the internship is to explore the use of different features (e.g. hand-crafted, tree - or graph-based features) for code representation. The intern will benchmark the performances of these code representations in a series of industry-relevant tasks (e.g. security relevant commit classification). Relevant References: [1] Sabetta, Antonino and Michele Bezzi. "A Practical Approach to the Automatic Classification of Security-Relevant Commits." 2018 IEEE International Conference on Software Maintenance and Evolution (ICSME). IEEE, 2018. [2] Alon, Uri, Meital Zilberstein, Omer Levy, and Eran Yahav. "code2vec: Learning distributed representations of code." Proceedings of the ACM on Programming Languages 3.POPL (2019): 40. [3] Ben-Nun, Tal, Alice Shoshana Jakobovits, and Torsten Hoefler. "Neural Code Comprehension: A Learnable Representation of Code Semantics." Advances in Neural Information Processing Systems 31, 2018. [4] Cabrera Lozoya, Rocío, et al. "Commit2vec: Learning distributed representations of code changes." SN Computer Science 2.3 (2021): 1-16. Some of the tasks to be addressed include: - Familiarize oneself with state-of-the-art machine learning techniques on code - Feature extraction from code representations, e.g. ASTs, intermediate or graph representations - Setup environment for training (Tensorflow, PyTorch, GPU) - Adapt ML techniques and network architectures to current problem - Train multiple machine learning systems and compare their performances We expect that 40% of time will be dedicated to development and 60% to research activities. **What you bring** - University Level: Last year of MSc in Computer Science or beyond - Solid programming foundations, hands-on knowledge of one or more languages (e.g. Java, Python) - Good knowledge of Machine Learning techniques and libraries - Familiarity with academic research is a plus - Fluency in English (working language) - Abilities in organizing meetings and contacting people - Good oral and written communication skills - Capacity to write documents in English, ability to synthesize - Peofessional experience: non required **Meet your team** Maintaining security is a constantly shifting task, and we need to respond with continuous learning and research. The portfolio of SAP Security Research contains those topics that we believe are most important for SAP’s security future. SAP’s vision to secure business is built on 3 ideals: Zero-Vulnerability, to harden the software by eliminating vulnerabilities, Defensible Application, to enable the software to identify and prevent attacks, and Zero-Knowledge, to make any theft of data useless through encryption. **We build breakthroughs together** **We win with inclusion** SAP’s culture of inclusion, focus on health and well-being, and flexible working models help ensure that everyone - regardless of background - feels included and can run at their best. At SAP, we believe we are made stronger by the unique capabilities and qualities that each person brings to our company, and we invest in our employees to inspire confidence and help everyone realize their full potential. We ultimately believe in unleashing all talent and creating a better and more equitable world. **EOE AA M/F/Vet/Disability**: Qualified applicants will receive consideration for employment without regard to their age, race, religion, national origin, ethnicity, age, gender (including pregnancy, childbirth, et al), sexual orientation, gender identity or expression, protected veteran status, or disability. Requisition ID: 347077 | Work Area: Information Technology | Expected Travel: 0 - 10% | Career Status: Student | Employment Type: Intern | Additional Locations: #LI-Hybrid.