All right thank you very much everyone for coming.
Today we're going to talk about how artificial intelligence can help you as a developer find horrible things before you hurt the people you love.
And horrible things we main application security bugs 7 how many people in the audience have ever written a bug.
We've all been there we've already in the bug how many of us have ever written something it turned out to be a security bug I have all right what kind of thing was it.
So it's like a configuration bugright so it's a simple oversight anyone could have made it configuration bug something like that.
You know I've made mistakes to where I'm like writing code and I'm like oh I'm supposed to really keep track of my head of how things work and I overlooked is just like you overlooked something and it turns out 84% of attacks happened because of a.
Issues like this.
So the question is what can we do to help you write code faster without making those kind of mistakes.
So last year we introduced artificial intelligence for finding application security flaws we call it microsoft security risk detection So what we do is we bring some of the same work we've been using the make windows better make office better make our own products better.
We bring it to you as a cloud service.
But what we did last year it was very manual it was something that you would sort manually log into a machine and fill out a wizard and get some bugs back what's new this year is we've integrated with visual studio team services.
I would add your logic apps.
And that's only show you today.
When the show you how you can start testing straight from your build definition and you can test as many times as you want?
As much as you want if you want to have the every new people request you can do that if you want to have every week you can do that and what we do is we bring all of the artificial intelligence we've been working on to help find horrible flaws in our code and fix them before we hurt the people we love.
It is you.
And we bring it to you.
And you'll see how the integrated into your workflow using the power of your logic apps.
And we can do this over and over and over again so enough of the slides let me sort of show you what we're talking about here.
I'm going to show you a small application this is a sample application all this code is on github you can go download it right now this is the application and then see.
Plus which is horrendous Lee dangerous to write code and as we all know and we have planted 10 horrendous bugs in this application you can go through and find 10 buffer overflows and River flows horrible things.
That will destroy your computer and let other people take over everything in your data center at least put them in here for you just for you and document at the mall.
So I've been able to check this out and I have this wonderful piece of code and you know what does it's all do I don't know.
I could sit here and try to read it for you I could sit here and try to read at the find those 10 horrible bugs well actually spoiler alert.
We've actually put in.
Comments that explain to you where the bugs are.
So this gives you an idea of the kind of stuff we can find with the say I technology this is a case where we just forgot to check the length of a string voice copied it happens to everyone right I see some people not in the audience.
Now.
Last year we showed you how to upload this to the cloud and manually fill out a wizard saying attack this code using our power of rei and with that wizard you could get a list of test cases that caused the crash that show you where it is.
But this year we can do something even more fun there is no more wizard.
There is only visual studio team services.
So what we've done is we've put into our build the ability to kick off a security testing job I'm queuing a new build up there and then what happens is.
After that build happens.
We can send events saying something new is happened something new testing has started a new bug has been found and what happens to those events those events go into Azure logic apps so let me show you what that looks like.
So this is a list of Azure logic apps and I'm going to get a new app that says alright whenever something has been created.
A new testing job is been created something might happen every week or every day you choose because you put it into your bill definition if you feel like this should happen every day you can do that on every poll request you can do that.
I can say whenever request is received I want to send an email.
And I can say all right what happens there I want to send the email to me so I can send it to demoan at Microsoft com here and sort of the information and that looks like.
That looks like this and all you get is a Jason which then you can of course turn into something more interesting you can create your own logic on top of this and say look I've got a new test case it started.
Here's where it starts when it starts and I can link that back straight to a web portal we have it shows you all of your tests as there being done and you can go back and say what's the status of all of these what's happening with all of them.
So if I want more I just had a new step here so let's suppose I want to annoy the hell out of everyone on teams when something new gets tested.
I want to put everyone in my entire organization on notice that were testing them for security flaws.
Well that's really easy I just go ahead and say teams.
And I have a connector here.
And I get a list of actions and I can say I want to post the message.
And I can say all right what's the unique ID who can I bother today.
Let's see there.
I need to bother.
Bring you right.
I need a team ID first of course.
There we go that's that's our organization.
And I'm going to bother them with this and I can completely include the body of the message which is all the data about the security testing so in this case I'm showing you the event that happens when the testing starts.
But we also in the best for when we find something that can tell you a link to the test case a link to all the details you can then put that into your workflow and say how do you want to handle it.
I'm like great I'll save that.
And what that looks like well that looks like this whenever something happens we end up getting an event posted to the teams which allows you to bother everyone in your organization and let them know something's happening.
Or you can write code on top of this it says whenever I find something really critical I want you to alert people and teams I don't want to alert people you know through email and then make sure the right people season at the right time.
So we've gone from something where you had to go to a website to use our special aiet having it disappeared into your build process it becomes something that you can just add another step.
And something that becomes as simple to use as just going through your.
Build definition so this is the build definition that we're using here.
And you can see it starts out just like any other build use nugget build the solution get the assemblies published symbols publish a drop and then we copy the files up to Azure because we can.
Their service copy the files from ajuran in order to start working on them.
And then you can say I want to just run microsoft security risk detection which is our service on that code.
And this is just something that become an you can see here it's the building succeeded and we end up getting a new build of the application and we end up sending information to our service and our services information back to you.
So we're giving you the flexibility to define how you want to manage security risk.
You decide who to notify you decide when you run it you decide what integrate with.
So we go back to Microsoft flows.
I've got this I'm saving this but there's actually over a thousand other connectors a thousand other connectors and more being added all the time.
I've I want to disconnect it I say I want another action.
So for instance if I want visual studio team services.
You can see here there's an essay email I showed you the logic flow in there is the email coming in my inbox saying something's been found.
Not go to visual studio team services I want to create a work item.
And I can say great I can create a work item whatever issue is found I can use the information I know about the build to assign it to the responsible person and after I signed a responsible person I can email their manager to make sure they actually do something about it.
And generally create a reign of terror it's great.
So this is all of the things that you need to just fill out right here.
Or.
I don't actually have to be restricted to the Microsoft ecosystem.
So I showed you teams coz that's what I happened to use myself I meant Microsoft but we have a connection for slack so how many people here are using slack.
About half of you are using slack no problem we can push the slack.
How many people are using jira?
OK how about half of you we've got connector for jeera and if there's a connector you want and we don't have.
You can go to uservoice an ask for it.
You can actually create your own connectors so how many people have heard of product studio at Microsoft.
OK one or 2 people we have this thing that we use inside Microsoft product studio it's obsolete everyone should use visual studio team services but if I wanted to build something that connects from logic apps to try to khudi oh I can do it.
I just have to write a service myself that speaks to specific contract this is expecting that's it so if you happen to have a homegrown bug ticketing system or 2 or 3 or 10 you can still use this to create all of the automation and logic for handling the security bugs.
And then connect it to whatever horrendous things in the 80s might be lurking around in your organization because I suddenly have that too.
So that's how we end up sort of connecting you to artificial intelligence and having it disappear into your workflow.
Now what I want to do is just go back and explain a little tiny bit before I wrap up around what it is that we're doing under the covers so this is a way of showing you all the different things that were testing it once.
You see here we are using windows for operating system image but we actually we are here to meet you where you are so how many people here right Linux applications.
OK a few people we support you too we can test you on Linux and in fact what we've done is we've been able to take our artificial intelligence are klaudy platform and extend it.
To Linux.
What we've done is we've taken something called neural fuzzing so this is part of our continuous effort to improve the research in the state of the art insecurity and artificial intelligence?
And we bring it to you you can use this right now today.
Our goal is to let you throw millions of test cases that your code to find horrendous corner cases.
Define security vulnerabilities.
Now previously there's a lot of different ways to do this the word fuzz testing starts in the dark and stormy night in Madison it was skansen the 1989 it's called fuzz testing because professor bart Miller was actually dialing into the modem pool.
I mean people remember modem pools.
OK so you remember line noise you remember how when the lightning happens all this crazy stuff happens on the line.
He notice that his applications would crash and he realized that what major could do he could force a grad student to simulate so he went back and made all his residence right lightning simulators and.
Attack common utilities of the time.
And now we have all these different methods of doing fuzz testing which are platform continually improves be can you integrate.
And our hypothesis was that we could make this better using the power of deep learning.
So we originally worked on several methods of deep learning for speech recognition so if you go and you take a look at the Microsoft translator booth here on the show floor you can see people doing real time speech translation.
You may have seen the discussion earlier with someone who is death speak talking to someone who speaks Mandarin.
That same technology that same deep learning is now available to you in Azure you can use the Azure aimatch platform to train your own deep learning and that's what we do.
For this buzzing.
We realized that if we took a look at some of these classic methods that are people use for doing security testing there's a random steps where people were rolling the dice to figure out what to attack next.
And we realized if we could figure out how to change that random step in the something that uses deep learning we might be able to find more bugs for you faster and we can we can.
We use azurea eye Patch we use tensor flow because Microsoft is here to meet you where you are to help you the customer no matter what kind of artificial intelligence do you need to use.
We're here to enable every person and every organisation the plan to achieve more.
And what we are able to do is after a 24 hour run of the existing original security testing mechanism called AFL it's open source you can all go look at it.
We able to train using azurea I bachon 12 hours and come up with a model that gave us 62 times increase the number of security crashes found 62 X improvement.
By using deep learning.
And what we've done is we've taken this and we're using Azure aimatch this is actually a screenshot from our diligent developers were working day and night to put this together you can see that we have a training asherati batch there as part of our.
Resources in Azure and this is one of our clusters waiting to start training waiting patiently to get ready to take on your code to go after your information in your security bugs.
And were able to get 62 X improvement and we're putting this into the product so everyone can have access to it.
So that's the long and short of what we've been able to do I'm coming to end of my time I am here for you I can answer all of your questions right here after the talk but the next steps.
We have a website you can learn everything you might want to know about microsoft security risk detection our way of bringing what we learn about artificial intelligence and security to the entire world you can sign up today.
You can learn about neural fuzzing which bills on top of the best Microsoft has to offer in our cloud platform and you can learn here at bill you can be the first to learn about all the fantastic possibilities.
That you can use to get 62 X improvements of your own.
And that is the whole value of becoming a Microsoft cloud developer.
So the recap we bring you AI it can disappear into your process it can make you a 62 X hero and you can learn all about it here at build thank you.