ML False Positive Token Filtering in Source Code

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing source code scanners often mischaracterize hardcoded tokens, leading to a high rate of false positives, which requires significant manual review and resource wastage, especially in large projects where dummy credentials and documentation files are incorrectly identified as sensitive information.

Innovation Solution

A machine learning model is employed to scan source code, identifying and filtering out false positives by analyzing patterns in the code, such as file paths and names, and updating the list of vulnerable tokens, which can be trained and adapted with new data to improve precision.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If rule-based scanners are used to identify hardcoded tokens, then token identification coverage is improved, but false positive rate increases

Engineering Contradiction:

Improvetoken identification accuracyVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

A machine learning model is introduced as an intermediary between the rule-based scanner and the final identification result. The scanner first identifies potential tokens using rules, then the ML model acts as a mediator to verify and filter these candidates, reducing false positives while maintaining identification coverage

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the purely mechanical rule-based filtering system with a machine learning-based classification system. The ML model learns from training data to distinguish between actual sensitive tokens and dummy/placeholder tokens, substituting rigid rule-based mechanics with adaptive intelligent classification

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Measurement precision

If manual review is performed to verify token accuracy, then identification precision is improved, but time consumption increases

Engineering Contradiction:

Improvetoken identification precisionVSAvoidreview time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The machine learning model enables the system to perform self-service by automatically classifying and filtering tokens without requiring manual review. The model learns from training data and autonomously distinguishes between sensitive and non-sensitive tokens, eliminating the need for time-consuming human verification

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system implements feedback mechanisms where the ML model is continuously trained and improved based on feedback from identified tokens. This allows the system to learn from past classifications and improve its precision over time, reducing the need for manual intervention while maintaining high accuracy

Inventive Principle:

Principle #23Feedback

3Quantity of substance

If comprehensive scanning rules are applied, then detection coverage is improved, but resource consumption increases

Engineering Contradiction:

Improvedetection coverageVSAvoidcomputational resource consumption

Core Design Contradiction:

Quantity of substanceVSLoss of energy

Solution Approach 1:

The system applies partial action by using rule-based scanning only for initial identification and then applying machine learning classification only to the subset of identified tokens. This avoids the excessive computational resource consumption of applying comprehensive ML analysis to entire codebases, while still achieving high detection coverage for actual sensitive tokens

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11481501B2Low false positive token identification in source code repositories using machine learning

Publication Date: 2022.10.25 SAP SE

AI summary

Source code is scanned to generate a list of vulnerable tokens. Thereafter, the list of vulnerable tokens is inputted into a machine learning model to identify false positives in the list of vulnerable tokens. Based on this identification, the list of vulnerable tokens can be modified to remove the identified false positives. Related apparatus, systems, techniques and articles are also described.