Abstract
Software developers frequently introduce vulnerable programs such as textual credentials and exploitable functions in software repositories during development and maintenance even though it is strictly advised against due to the severe threat to the security of the software. Software developers often introduce vulnerabilities like textual credentials and exploitable functions during development. These vulnerabilities create attack surfaces exploitable by an adversary to compromise the security of a software. Consequently, successful attacks cost organizations financial and human resources. In this dissertation, we handle these vulnerabilities through detection and interception. We tackle the detection and interception of vulnerabilities in the design, microarchitecture, performance, and insecure code components of the software. Hence for that endeavor, we propose SEAL, SPECDET, DANCE, PACE, VulStyle, and SiTM. SEAL is a secure design pattern approach toward tackling lateral injection attacks. It decomposes user and security level features into independent but collaborative components to tackle lateral-based in-band injection attacks. SPECDET is a static and micro architectural machine learning approach for detecting spectre vulnerabilities and attacks. DANCE is an approach for detecting credentials embedded in code via large language models vulnerable to backdoor attacks. PACE is a program analysis framework that provides continuous feedback on the performance impact of pending code updates. VulStyle is a pre-trained, multimodal programming language model for software vulnerability detection. It enhances code representation by selecting non-terminal nodes and integrating code stylometry features. Finally, to prevent the introduction of detected vulnerabilities, we propose Security-in-the-Middle (SiTM), an automated approach towards the interception of transiting vulnerabilities during software development. It creates a secure state between the developer and the source code management systems, thus ensuring that only secure code is permitted in the software. We propose the integration of SiTM into git and continuous integration pipelines. A significant majority of data breaches and cyber attacks originate from exploitable vulnerabilities in the code introduced during development. Hence, the goal of our work is to proactively reduce prospective malicious exploits ensuring the security of the software from inception.