# US 2020/0401702 A1 · Method and System for Reducing False Positives in Static Source Code Analysis Reports Using Machine Learning and Classification Techniques

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401702 A1
- Document ID: US20200401702A1
- Status: Published application
- Kind: A1
- Application number: 16/911,373
- Filed: 2020-06-24
- Published: 2020-12-24
- Earliest claimed: 2019-06-24
- Assignees: University of Maryland, Baltimore County
- Applicants: University of Maryland Baltimore County
- Inventors: George Karabatis; Foteini Cheirdari-Argiropoulos
- Web page: https://patentgrep.com/patent/US20200401702A1

## CPC

- G06F 8/75: Structural analysis for program understanding
- G06F 18/24: Classification techniques
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06N 20/00: Machine learning
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

This invention is a computer-implemented method and system of using a secondary classification algorithm after using a primary source code vulnerability scanning tool to more accurately label true and false vulnerabilities in source code. The method and system use machine learning within a 10% dataset to develop a classifier model algorithm. A selection process identifies the most important features utilized in the algorithm to detect and distinguish the true and false positive findings of the static code analysis results. A personal identifier is used as a critical feature for the classification. The model is validated by experimentation and comparison against thirteen existing classifiers.

## Claims

### Claim 1

A process comprising:
Generating a Classifier Model Using Machine Learning on a Training Component Data Set of about 10% a Master Data Set,
wherein the Master Data Set comprises a Scan Tool Vulnerabilities report (csv) generated using one or more open source or proprietary vulnerability scanning tools on static source code that contains True Positive Vulnerabilities and False Positive Vulnerabilities;
Testing/Analyzing the Master Data Set Using the Classifier Model to eliminate 90-95% of False Positives from the Master Data Set;
Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than the Master Data Set;
wherein the method is performed by one or more computing devices.

### Claim 2 (depends on 1)

A system comprising:
one or more processors;
one or more storage media storing instructions which, when executed by the one or more processors, cause the steps of the process of claim 1 to be performed.

### Claim 3

A computer-implemented method for labelling true and false vulnerabilities in software code (during static code analysis), comprising:
Providing non-running (static) source code;
Applying a classification algorithm with its variants to a 10% selection of the source code to label software vulnerabilities in the source code as true or false to generate a classifier model;
Applying a selection process to identify a plurality of most important features used in the algorithm to detect and distinguish the true and false positive findings of the classifier model containing source code analysis results using empirical and semantic method of identifying and using personal identifier as a critical feature for classification validated by experimentation and comparison to 13 existing classifiers;
Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than a vulnerabilities report generated by existing classifiers without the classifier model;
wherein the method is performed by one or more computing devices.

### Claim 4 (depends on 3)

A system comprising:
one or more processors;
one or more storage media storing instructions which, when executed by the one or more processors, cause the steps of the process of claim 3 to be performed.

### Claim 5

A computer-implemented method for labeling true and false vulnerabilities in software code after static code analysis, comprising:
Scanning source code using a plurality of source code analysis tools, and aggregating scan results into a CSV file of potential vulnerabilities;
Selecting a subset of the potential vulnerabilities based on the severity status to identify most critical ones for manual examination and labeling the vulnerabilities as true or false positive;
Creating a training and a testing dataset using machine learning software WEKA and a stratified sampling technique;
Applying 13 different open source classifiers on the testing dataset;
Identifying one of the 13 different open source classifiers as having a highest accuracy and using the highest accuracy open source classifier to determine and validate a best feature selection result;
Applying to the CSV file the 13 different open source classifers with the relevant features identified and recording the results (false and true positive);
wherein the method is performed by one or more computing devices.

### Claim 6 (depends on 5)

A system comprising:
one or more processors;
one or more storage media storing instructions which, when executed by the one or more processors, cause the steps of the process of claim 5 to be performed.

### Claim 7

A networked method using one or more processors;
one or more storage media storing instructions which, when executed by the one or more processors, cause:
STEP 1—receiving Source Code from a customer;
STEP 2—performing a vulnerability scan using one or more open source or proprietary scanning tools on the static source code;
STEP 3—generating Scan Tool Vulnerabilities Report (csv) containing a Master Data Set of True Positive Vulnerabilities and False Positive Vulnerabilities;
STEP 4 —Generating a Classifier Model Using Machine Learning on a Training Component Data Set of about 10% the Master Data Set;
STEP 5—Testing/Analyzing the Master Data Set Using the Classifier Model to eliminate 90-95% of False Positives from the Master Data Set; and
STEP 6—Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than the Master Data Set.

### Claim 8

A networked method using one or more processors;
one or more storage media storing instructions which, when executed by the one or more processors, cause:
STEP 1—receiving a Scan Tool Vulnerabilities Report (csv) containing a Master Data Set of True Positive Vulnerabilities and False Positive Vulnerabilities, the Scan Tool Vulnerabilities Report (csv) generated by performing a vulnerability scan using one or more open source or proprietary scanning tools on static source code;
STEP 2 —Generating a Classifier Model Using Machine Learning on a Training Component Data Set of about 10% the Master Data Set;
STEP 3—Testing/Analyzing the Master Data Set Using the Classifier Model to eliminate 90-95% of False Positives from the Master Data Set; and
STEP 4—Outputting an Enhanced Vulnerabilities Report containing 90-95% less False Positives than the Master Data Set.