{"id":"W2976928731","doi":"10.1016/j.jss.2019.110427","title":"An empirical study of security warnings from static application security testing tools","year":2019,"lang":"en","type":"article","venue":"Journal of Systems and Software","topic":"Software Engineering Research","field":"Computer Science","cited_by":52,"is_retracted":false,"has_abstract":false,"ca_institutions":"University of Victoria; University of Waterloo","funders":"","keywords":"Computer science; False positive paradox; Source code; Application security; Vulnerability (computing); Computer security; Static program analysis; Static analysis; Code (set theory); Open source; Web application security; Software security assurance; Empirical research; Secure coding; Software; Data mining; Information security; Software development; The Internet; World Wide Web; Machine learning; Security service; Set (abstract data type); Programming language","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.001018948,0.0001159217,0.0003802016,0.0001360021,0.00005085345,0.0001888289,0.0005481652,0.0000648579,0.000002470818],"category_scores_gemma":[0.0008891324,0.00009532864,0.00003597388,0.000315698,0.00001629615,0.0006945053,0.0001139667,0.0003279738,0.00000323936],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.00005363356,"about_ca_system_score_gemma":0.00007836874,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0003057616,"about_ca_topic_score_gemma":0.000003757757,"domain_scores_codex":[0.9982559,0.0001579171,0.0005519903,0.0002319225,0.0006305107,0.0001717676],"domain_scores_gemma":[0.996902,0.001626267,0.0004209034,0.0004111974,0.0004845829,0.0001550635],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"observational","study_design_gemma":"observational","study_design_scores_codex":[0.000009278772,0.0002052716,0.9803022,0.0001385947,0.00003572607,0.00001611079,0.01320278,0.001044171,0.0002600661,0.00001286896,0.00004819512,0.004724765],"study_design_scores_gemma":[0.001371833,0.002250584,0.8787236,0.000367163,0.00002447218,0.0001137353,0.00303734,0.112694,0.00007310823,0.0008490579,0.000235845,0.000259282],"study_design_candidate":"observational","study_design_consensus":"observational","genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.9381452,0.0002868253,0.06089734,0.00001895847,0.0002036749,0.0003858295,0.000005997952,0.00005384602,0.000002342861],"genre_scores_gemma":[0.9953234,0.000003139406,0.004543338,0.000008498524,0.00009934879,0.000008429912,0.000001031995,0.00001020046,0.000002614359],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.1116499,"threshold_uncertainty_score":0.3887389,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02707849916874567,"score_gpt":0.3027242912348174,"score_spread":0.2756457920660717,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}