Security vulnerability analysis of code based on machine learning and variable usage

A system for analyzing software for security vulnerabilities comprising:

• one or more memories;
• and
• at least one processor coupled to the one or more memories, and configured to:
• analyze information from a security scan of code to identify a security issue pertaining to a code portion;
• determine, via a machine learning model, an initial risk factor score for the security issue based on a history of information pertaining to one or more prior security scans;
• refine the initial risk factor score to produce an overall risk factor score for the security issue based on a confidence of the initial risk factor score, wherein the initial risk factor score is refined based on one or more risk factor scores for operations within the code applied to a variable of the code portion;
• and
• determine a classification of the security issue as one of a valid security issue and a false positive based on the overall risk factor score.

A computer program product for analyzing software for security vulnerabilities, the computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by at least one processor to cause the at least one processor to:

• analyze information from a security scan of code to identify a security issue pertaining to a code portion;
• determine, via a machine learning model, an initial risk factor score for the security issue based on a history of information pertaining to one or more prior security scans;
• refine the initial risk factor score to produce an overall risk factor score for the security issue based on a confidence of the initial risk factor score, wherein the initial risk factor score is refined based on one or more risk factor scores for operations within the code applied to a variable of the code portion;
• and
• determine a classification of the security issue as one of a valid security issue and a false positive based on the overall risk factor score.