# US 2021/0240834 A1 · Low False Positive Token Identification in Source Code Repositories using Machine Learning

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0240834 A1
- Document ID: US20210240834A1
- Status: Published application
- Kind: A1
- Application number: 16/778,872
- Filed: 2020-01-31
- Published: 2021-08-05
- Earliest claimed: 2020-01-31
- Assignees: Sap SE
- Applicants: Sap SE
- Inventors: Slim Trabelsi; Sofiane Lounici; Marco Rosa; Carlo Maria Negri
- Web page: https://patentgrep.com/patent/US20210240834A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06N 3/08: Learning methods
- G06N 3/09: Supervised learning
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- G06N 20/20: Ensemble learning
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS

## Abstract

Source code is scanned to generate a list of vulnerable tokens. Thereafter, the list of vulnerable tokens is inputted into a machine learning model to identify false positives in the list of vulnerable tokens. Based on this identification, the list of vulnerable tokens can be modified to remove the identified false positives. Related apparatus, systems, techniques and articles are also described.

## Claims

### Claim 1

A computer-implemented method comprising:
scanning source code to generate a list of vulnerable tokens;
inputting, the list of vulnerable tokens, into a machine learning model to identify false positives in the list of vulnerable tokens; and
modifying the list of vulnerable tokens to remove the identified false positives.

### Claim 2 (depends on 1)

The method of claim 1, wherein the scanning occurs prior to uploading of the source code to a source code repository.

### Claim 3 (depends on 1)

The method of claim 1, wherein the scanning occurs prior to publishing of the source code on a source code repository.

### Claim 4 (depends on 1)

The method of claim 1, wherein the scanned source code is published on a publically available source code repository.

### Claim 5 (depends on 4)

The method of claim 4, wherein the scanning occurs periodically subsequent to publishing of source code on the publically available source code repository.

### Claim 6 (depends on 1)

The method of claim 1, wherein the machine learning model is at least one of a: logistic regression model, a neural network, a Random Forest, a support vector machine, or a text classification and representation learning model.

### Claim 7 (depends on 1)

The method of claim 1 further comprising:
rendering the modified list of vulnerable tokens into a graphical user interface as a list of entries with corresponding graphical user interface elements; and
receiving user-generated input selecting at least one of the graphical user interfaces to modify at least one entry in the list of vulnerable tokens.

### Claim 8 (depends on 1)

The method of claim 1 further comprising at least one of: transmitting the modified list of vulnerable tokens to a remote computing device, providing the modified list of vulnerable tokens to a code scanner scanning the source code, loading the modified list of vulnerable tokens in memory, or storing the modified list of vulnerable tokens in physical persistence.

### Claim 9

A system comprising:
at least one data processor; and
memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
scanning source code to generate a list of vulnerable tokens;
inputting, the list of vulnerable tokens, into a machine learning model to identify false positives in the list of vulnerable tokens; and
modifying the list of vulnerable tokens to remove the identified false positives.

### Claim 10 (depends on 9)

The system of claim 9, wherein the scanning occurs prior to uploading of the source code to a source code repository.

### Claim 11 (depends on 9)

The system of claim 9, wherein the scanning occurs prior to publishing of the source code on a source code repository.

### Claim 12 (depends on 9)

The system of claim 9, wherein the scanned source code is published on a publically available source code repository.

### Claim 13 (depends on 12)

The system of claim 12, wherein the scanning occurs periodically subsequent to publishing of source code on the publically available source code repository.

### Claim 14 (depends on 9)

The system of claim 9, wherein the machine learning model is at least one of a: logistic regression model, a neural network, a Random Forest, a support vector machine, or a text classification and representation learning model.

### Claim 15 (depends on 9)

The system of claim 9, wherein the operations further comprise:
rendering the modified list of vulnerable tokens into a graphical user interface as a list of entries with corresponding graphical user interface elements; and
receiving user-generated input selecting at least one of the graphical user interfaces to modify at least one entry in the list of vulnerable tokens.

### Claim 16 (depends on 9)

The system of claim 9, wherein the operations further comprise at least one of: transmitting the modified list of vulnerable tokens to a remote computing device, providing the modified list of vulnerable tokens to a code scanner scanning the source code, loading the modified list of vulnerable tokens in memory, or storing the modified list of vulnerable tokens in physical persistence.

### Claim 17

A non-transitory computer program product storing instructions which, when executed by at least one computing device, result in operations comprising:
scanning source code to generate a list of vulnerable tokens;
inputting, the list of vulnerable tokens, into a machine learning model to identify false positives in the list of vulnerable tokens; and
modifying the list of vulnerable tokens to remove the identified false positives.

### Claim 18 (depends on 17)

The computer program product of claim 17, wherein the scanning occurs at least one of: prior to uploading of the source code to a source code repository or prior to publishing of the source code on a source code repository.

### Claim 19 (depends on 17)

The computer program product of claim 17, wherein:
the scanned source code is published on a publically available source code repository; and
the scanning occurs periodically subsequent to publishing of source code on the publically available source code repository.

### Claim 20 (depends on 19)

The computer program product of claim 19, wherein:
the machine learning model is at least one of a: logistic regression model, a neural network, a Random Forest, a support vector machine, or a text classification and representation learning model; and
the operations further comprise:
rendering the modified list of vulnerable tokens into a graphical user interface as a list of entries with corresponding graphical user interface elements; and
receiving user-generated input selecting at least one of the graphical user interfaces to modify at least one entry in the list of vulnerable tokens.