## Inspiration

The best way to learn to code is usually through trial and error. As a team, we all know first hand how hard it can be to maintain the proper standards, techniques, and security practices necessary to keep your applications secure. SQLidify is a teaching tool and a security tool all in one, with the goal of helping coders keep their applications secure.

## What it does

SQLidify uses our own unique dataset/training model which consists of over 250 labelled data entries to identify SQL vulnerabilities in an application. To use it, simply paste your code into our website where our machine learning model will identify vulnerabilities in your back-end code, and then will suggest strategies to fix these issues.

## How we built it

We used a Flask, python based backend that handles API calls from a front end designed in React.js and Tailwind CSS. When called, our python backend reads data from users and then sends the data to our AI model. At the same time, our own simplified natural language processing model identifies keywords in specific lines of code and sends these lines individually to our AI model. The model makes a prediction for each which is then compared to help improve reliability. If the predictions don't match, further instructions are sent to the user in order to improve our accuracy.

The AI is designed using Cohere's classification workflow. We generated over 250 code snippets labeled as either vulnerable or safe. We have another model that is triggered if the code is determined to be vulnerable, which will then generate 3 appropriate options to resolve the vulnerabilities.

## Challenges we ran into

We had trouble setting up cohere and getting it to integrate with our application, but we were luckily able to resolve the issues in time to build our app. We also had a lot of trouble finding a dataset fit for our needs so we ended up creating our own from scratch.

## Accomplishments that we're proud of

Despite setbacks, we managed to integrate the AI and React frontend and Flask backend all together in less than 24 hours.

## What we learned

We all learned so much about machine learning and Cohere in particular, since none of us were experienced at working with AI until McHacks.

## What's next for SQLidify

Expansion. We hope to eventually integrate detection for other vulnerabilities such as buffer overflow and many more.
## Inspiration

The inspiration for the project was our desire to make studying and learning more efficient and accessible for students and educators. Utilizing advancements in technology, like the increased availability and lower cost of text embeddings, to make the process of finding answers within educational materials more seamless and convenient.

## What it does

Wise Up is a website that takes many different types of file format, as well as plain text, and separates the information into "pages". Using text embeddings, it can then quickly search through all the pages in a text and figure out which ones are most likely to contain the answer to a question that the user sends. It can also recursively summarize the file at different levels of compression.

## How we built it

With blood, sweat and tears! We used many tools offered to us throughout the challenge to simplify our life. We used Javascript, HTML and CSS for the website, and used it to communicate to a Flask backend that can run our python scripts involving API calls and such. We have API calls to openAI text embeddings, to cohere's xlarge model, to GPT-3's API, OpenAI's Whisper Speech-to-Text model, and several modules for getting an mp4 from a youtube link, a text from a pdf, and so on.

## Challenges we ran into

We had problems getting the backend on Flask to run on a Ubuntu server, and later had to instead run it on a Windows machine. Moreover, getting the backend to communicate effectively with the frontend in real time was a real challenge. Extracting text and page data from files and links ended up taking more time than expected, and finally, since the latency of sending information back and forth from the front end to the backend would lead to a worse user experience, we attempted to implement some features of our semantic search algorithm in the frontend, which led to a lot of difficulties in transferring code from Python to Javascript.

## Accomplishments that we're proud of

Since OpenAI's text embeddings are very good and very new, and we use GPT-3.5 based on extracted information to formulate the answer, we believe we likely equal the state of the art in the task of quickly analyzing text and answer complex questions on it, and the ease of use for many different file formats makes us proud that this project and website can be useful for so many people so often. To understand a textbook and answer questions about its content, or to find specific information without knowing any relevant keywords, this product is simply incredibly good, and costs pennies to run. Moreover, we have added an identification system (users signing up with a username and password) to ensure that a specific account is capped at a certain usage of the API, which is at our own costs (pennies, but we wish to avoid it becoming many dollars without our awareness of it.

## What we learned

As time goes on, not only do LLMs get better, but new methods are developed to use them more efficiently and for greater results. Web development is quite unintuitive for beginners, especially when different programming languages need to interact. One tool that has saved us a few different times is using json for data transfer, and aws services to store Mbs of data very cheaply. Another thing we learned is that, unfortunately, as time goes on, LLMs get bigger and so sometimes much, much slower; api calls to GPT3 and to Whisper are often slow, taking minutes for 1000+ page textbooks.

## What's next for Wise Up

What's next for Wise Up is to make our product faster and more user-friendly. A feature we could add is to summarize text with a fine-tuned model rather than zero-shot learning with GPT-3. Additionally, a next step is to explore partnerships with educational institutions and companies to bring Wise Up to a wider audience and help even more students and educators in their learning journey, or attempt for the website to go viral on social media by advertising its usefulness. Moreover, adding a financial component to the account system could let our users cover the low costs of the APIs, aws and CPU running Whisper.
## Inspiration

Compiled C and C++ binaries compose a large portion of the software vulnerabilities present in today's server and commercial codebase. Oftentimes, these vulnerabilities can be detected and prevented by static analysis algorithms, such as the CLang static analyzer. However, with ever increasing complexity and frequency of exploits involving various mechanisms of memory corruption and arbitrary program control, static methods are becoming ineffective in identifying all possible attack surfaces in a given program. Machine learning, a powerful data analysis technique that has been used for finding patterns in a wide variety of datasets, is proposed to be a solution to more quickly and effectively identify potential weak points in a program so that they may be patched before deployment.

## What it does

CodeHeat (short for automatic Code Heat Map analysis), is a machine-learning based vulnerability detection built specifically for C and C++ programs, but whose concepts may be easily expanded to perform similar analysis on programs in other languages. Instead of analyzing compiled binaries - which is what disassembers such as IDA and Ghidra do - CodeHeat analyzes the source program directly, exactly what is visible to the developer. This offers several advantages: first, source file analysis allows the developer to make changes to his or her program as it is being built, without having to repeatedly wait for compilation. Furthermore, vulnerabilities at the source level are much easier for the developer to identify and fix. This is much easier than having to map the compiled code back to the text to address a vulnerability.

## How we built it

The machine learning library used to generate, train, and evaluate the model was Keras, which runs atop Tensorflow. Since Keras is a Python library, all analysis programs we built were written in Python. The data that is passed to the classifier is a series of tokens - C / C++ text source files had to first be tokenized with a lexer. The lexer was implemented from scratch in Python using the PLY (Python Lex-Yacc) library. The machine learning model itself consists of 7 types of internal layers: (1) embedding layer, (2) reshaping layer, (3) 2-dimensional convolutional layer, (4) a maximum pooling layer, (5) a flattening layer, (6) a dropout layer, and (7) dense layers (there are three). Parameters were selected according toa previous [research paper](https://arxiv.org/pdf/1807.04320.pdf?fbclid=IwAR15RDmbxQS_b-2bETRimOsgLpfTTOCd5Eno2fcmxLbauBZNpBKemtAXZoo) investing the properties of a similar vulnerability generation.

The convolutional neural network is apposite for this application because the tokens are embedded into a higher space, resulting in a block of program text to be representable by an intensity image. In programming, neighboring tokens are known to affect each others' meanings, and the convolution reflects this proximity.

## Challenges we ran into

Tokenization of the C code became our biggest challenge. The research paper we were following used their own custom tokenizer that reduced the token space to 156 symbols, and we had a hard time matching that, while still accounting for the different symbols that could be captured.

## Accomplishments that we're proud of

We picked an idea that we thought was interesting, and we stuck with it beginning to end no matter the challenges. We've had to overcome many hurdles and although we didn't make the results that we would have liked, we are very happy with the progress we made.

## What we learned

We learned about the process of lexing program text data into a set of symbols that makes it easiest for a machine learning model to find patterns among the program data. We also expanded our thinking about machine learning and its applicability to various problems - even though our datsets were text files (at most described by a one-dimensional string of characters), embedding into a higher space and using convolution enables patterns that would otherwise be difficult to observe to become clear.

## What's next for ML-Based Software Vulnerability Detection

To improve CodeHeat, the central model must be trained to better identify offending code. This can be accomplished by selecting appropriate token rules for a tokenizer that more effectively represents the program code and meaning. Additionally, visualization of which parts of the code are most vulnerable would also be desirable. Visualization of which parts of the code are likely the most dangerous can be obtained by careful use of the output layer of the beginning of the convolutional network.