SAPI Algorithm for False Positive Reduction in Static Code Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current static code analysis tools struggle to accurately distinguish between true and false positives, leading to a tedious and time-consuming manual review process for software assurance analysts, which can compromise the security posture of software systems.

Innovation Solution

A novel classification algorithm, the Software Assurance Personal Identifier (SAPI) is developed, utilizing a personal identifier and file properties to enhance the accuracy of identifying true and false positives, with a smaller training dataset and unique weights assigned to vulnerability features, significantly improving the classification of vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual review of all potential vulnerabilities is performed, then accuracy in identifying true and false positives is improved, but time consumption and labor intensity increase significantly

Engineering Contradiction:

Improveaccuracy in identifying true and false positivesVSAvoidtime consumption for manual review

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent introduces an intermediary classification system that acts as a mediator between automated static code analysis tools and manual review processes. The classification algorithm analyzes multiple features of vulnerabilities (code context, vulnerability type, file properties) to automatically categorize findings as true positives or false positives, significantly reducing the burden on manual reviewers while maintaining high accuracy.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces the mechanical manual review process with an automated classification algorithm that uses machine learning and feature analysis. This substitution eliminates the need for human analysts to manually examine every vulnerability finding, instead using computational methods to accurately distinguish true positives from false positives at scale.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Difficulty of detecting and measuring

If current static code analysis tools are used, then vulnerability detection is performed, but the ability to accurately distinguish true and false positives is limited

Engineering Contradiction:

Improveability to distinguish true and false positivesVSAvoidaccuracy of vulnerability identification

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent changes the parameters used for vulnerability classification by incorporating multiple features beyond simple code patterns. These features include code context, vulnerability type, file properties, and historical data. By changing from single-parameter detection to multi-parameter classification, the system achieves significantly improved accuracy in distinguishing true positives from false positives.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent creates a composite classification approach that combines multiple analysis methods and feature types into a unified vulnerability identification system. Rather than relying on a single detection method, the system integrates pattern matching, statistical analysis, and machine learning techniques to create a more reliable and accurate classification mechanism.

Inventive Principle:

Principle #40Composite materials

3Reliability

If all potential vulnerabilities are reviewed manually, then comprehensive security assessment is achieved, but productivity and efficiency are reduced

Engineering Contradiction:

Improvecomprehensive security assessmentVSAvoidefficiency of vulnerability review process

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The patent applies partial action by having the classification algorithm handle the majority of vulnerability findings automatically, reserving manual review only for cases that require human judgment. This partial automation approach maintains comprehensive security assessment while significantly improving productivity by eliminating the need for manual review of clearly identifiable false positives and obvious true positives.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11620389B2Method and system for reducing false positives in static source code analysis reports using machine learning and classification techniques

Publication Date: 2023.04.04 UNIV OF MARYLAND BALTIMORE COUNTY

AI summary

This invention is a computer-implemented method and system of using a secondary classification algorithm after using a primary source code vulnerability scanning tool to more accurately label true and false vulnerabilities in source code. The method and system use machine learning within a 10% dataset to develop a classifier model algorithm. A selection process identifies the most important features utilized in the algorithm to detect and distinguish the true and false positive findings of the static code analysis results. A personal identifier is used as a critical feature for the classification. The model is validated by experimentation and comparison against thirteen existing classifiers.