Method and System for Reducing False Positives in Static Source Code Analysis Reports Using Machine Learning and Classification Techniques

A computer-implemented method for labelling true and false vulnerabilities in software code (during static code analysis), comprising:

• Providing non-running (static) source code;
• Applying a classification algorithm with its variants to a 10% selection of the source code to label software vulnerabilities in the source code as true or false to generate a classifier model;
• Applying a selection process to identify a plurality of most important features used in the algorithm to detect and distinguish the true and false positive findings of the classifier model containing source code analysis results using empirical and semantic method of identifying and using personal identifier as a critical feature for classification validated by experimentation and comparison to 13 existing classifiers;
• Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than a vulnerabilities report generated by existing classifiers without the classifier model;
• wherein the method is performed by one or more computing devices.

A computer-implemented method for labeling true and false vulnerabilities in software code after static code analysis, comprising:

• Scanning source code using a plurality of source code analysis tools, and aggregating scan results into a CSV file of potential vulnerabilities;
• Selecting a subset of the potential vulnerabilities based on the severity status to identify most critical ones for manual examination and labeling the vulnerabilities as true or false positive;
• Creating a training and a testing dataset using machine learning software WEKA and a stratified sampling technique;
• Applying 13 different open source classifiers on the testing dataset;
• Identifying one of the 13 different open source classifiers as having a highest accuracy and using the highest accuracy open source classifier to determine and validate a best feature selection result;
• Applying to the CSV file the 13 different open source classifers with the relevant features identified and recording the results (false and true positive);
• wherein the method is performed by one or more computing devices.

A networked method using one or more processors;

• one or more storage media storing instructions which, when executed by the one or more processors, cause:
• STEP 1—receiving Source Code from a customer;
• STEP 2—performing a vulnerability scan using one or more open source or proprietary scanning tools on the static source code;
• STEP 3—generating Scan Tool Vulnerabilities Report (csv) containing a Master Data Set of True Positive Vulnerabilities and False Positive Vulnerabilities;
• STEP 4 —Generating a Classifier Model Using Machine Learning on a Training Component Data Set of about 10% the Master Data Set;
• STEP 5—Testing/Analyzing the Master Data Set Using the Classifier Model to eliminate 90-95% of False Positives from the Master Data Set;
• and
• STEP 6—Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than the Master Data Set.

A networked method using one or more processors;

• one or more storage media storing instructions which, when executed by the one or more processors, cause:
• STEP 1—receiving a Scan Tool Vulnerabilities Report (csv) containing a Master Data Set of True Positive Vulnerabilities and False Positive Vulnerabilities, the Scan Tool Vulnerabilities Report (csv) generated by performing a vulnerability scan using one or more open source or proprietary scanning tools on static source code;
• STEP 2 —Generating a Classifier Model Using Machine Learning on a Training Component Data Set of about 10% the Master Data Set;
• STEP 3—Testing/Analyzing the Master Data Set Using the Classifier Model to eliminate 90-95% of False Positives from the Master Data Set;
• and
• STEP 4—Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than the Master Data Set.