{"id":"W2976928731","doi":"10.1016/j.jss.2019.110427","title":"An empirical study of security warnings from static application security testing tools","year":2019,"lang":"en","type":"article","venue":"Journal of Systems and Software","topic":"Software Engineering Research","field":"Computer Science","cited_by":52,"is_retracted":false,"has_abstract":false,"ca_institutions":"University of Victoria; University of Waterloo","funders":"","keywords":"Computer science; False positive paradox; Source code; Application security; Vulnerability (computing); Computer security; Static program analysis; Static analysis; Code (set theory); Open source; Web application security; Software security assurance; Empirical research; Secure coding; Software; Data mining; Information security; Software development; The Internet; World Wide Web; Machine learning; Security service; Set (abstract data type); Programming language","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.01005699,0.0004452225,0.0002785521,0.002441551,0.0005882729,0.001317304,0.001258446,0.001128852,0.002663076],"category_scores_gemma":[0.194099,0.0003651463,0.0004090206,0.001672855,0.001235814,0.003175851,0.001299422,0.002282852,0.0004996824],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0009121716,"about_ca_system_score_gemma":0.001211864,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00223854,"about_ca_topic_score_gemma":0.002998101,"domain_scores_codex":[0.9923742,0.003190115,0.0008063075,0.0005011481,0.002787379,0.0003407997],"domain_scores_gemma":[0.5511046,0.3705495,0.04404118,0.01070186,0.02098966,0.00261317],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"observational","study_design_gemma":"observational","study_design_scores_codex":[0.001713985,0.007601459,0.9236866,0.0003540171,0.0001434724,0.0006070507,0.01161525,0.001393536,0.002453068,0.001658668,0.001048459,0.04772438],"study_design_scores_gemma":[0.0002088293,0.006400089,0.9524554,0.0002788236,0.0002560319,0.001193688,0.01274299,0.01772988,0.004432675,0.001354631,0.002859852,0.0000871244],"study_design_candidate":"observational","study_design_consensus":"observational","genre_codex":"empirical","genre_gemma":"empirical","genre_scores_codex":[0.9985912,0.00004422081,0.000487126,0.0000619564,0.000004876744,0.00003597984,0.00005597359,0.00001178514,0.0007068848],"genre_scores_gemma":[0.9990506,0.00003041204,0.0005203596,0.00002529157,0.000003448145,0.00002566831,0.0001094755,0.000008352868,0.0002265394],"genre_candidate":"empirical","genre_consensus":"empirical","teacher_disagreement_score":0.01005699,"threshold_uncertainty_score":0.05318707,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.02707849916874567,"score_gpt":0.3027242912348174,"score_spread":0.2756457920660717,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}