Patent ID: 7487545

Claim:
A computer-implemented method for determining a level of security for a portion of software code, the method comprising: determining a number of security vulnerabilities for the portion of software code by invoking one or more source code analysis tools; receiving one or more output logs from the one or more source code analysis tools; parsing the one or more output logs for a tag; identifying each instance of the tag in the one or more output logs as a security vulnerability; correlating the one or more output logs; determining a weight for the security vulnerability identified based on at least one of a reputation of a source code analysis tool that reported it, a severity that the source code analysis tool reported, and a number of source code analysis tools that reported the security vulnerability; determining, for each security vulnerability in the number of security vulnerabilities for the portion of software code, a vulnerability level, wherein the vulnerability level is one of critical, serious, and inconsequential; determining a security level score for the portion of software code, wherein the security level score is probabilistically linked to the number of security vulnerabilities, wherein determining the security level score for the portion of software code includes weighting the each security vulnerability based on its corresponding vulnerability level and calculating the security level score using the following equation: score=100−(100*((( h*hw )+( m*mw+l )/ loc ))[floor=0] where h is a number of vulnerabilities with a critical rating, hw is a weight for critical vulnerabilities, m is a number of vulnerabilities with a serious rating, mw is a weight for medium vulnerabilities, l is a number of vulnerabilities with a low or inconsequential rating, and loc is a number of lines of code in the portion of software code.