Patent Document ID: 10097574
Application ID: 14576118
Patent Flag: 1

Claim One:
1. A method to reduce false alarms generated by an automated analysis tool performing static security analysis, comprising: receiving a set of data representing findings generated by the automated analysis tool performing the static security analysis, wherein the automated analysis tool generates findings by static security analysis of a call-tree representing call stacks of an application under analysis and wherein at least one of the findings represents a vulnerability in the form of an unvalidated flow from a source to a sink in the application; with respect to a subset of the data, the subset of data being generated by random or pseudo-random sampling of the set of data, receiving user-generated classifications for each of the findings in the subset, the user-generated classification being that a particular finding either is true or false, wherein a remainder of the received set of data does not receive user-generated classifications; based on the user-generated classifications received with respect to the subset of the data, computing a machine learning classifier using software executing in a hardware element by: reducing each finding to a feature vector comprising a set of features common to each finding, wherein the set of features include one of: witness length, source type, sink type, witness type, conditional statements, method calls and string operations generated by the automated analysis tool performing the static security analysis; assigning weights to each of the set of features; and based on the assigned weights, computing a weighting function having a threshold value that determines a correctness of a new finding; and applying the machine learning classifier to the remainder of the received set of data to determine a fitness of the machine learning classifier to classify other findings generated by the static security analysis.