Security vulnerability analysis of code based on machine learning and variable usage

1 . A method of analyzing software for security vulnerabilities comprising:

analyzing, via at least one processor, information from a security scan of code to identify a security issue pertaining to a code portion;

determining, via a machine learning model of the at least one processor and at a current stage of a lifecycle chain corresponding to a variable associated with the security issue, an initial risk factor score for an operation applied to the variable, wherein the initial risk factor score is determined based at least in part on a risk weight value corresponding to a previous stage of the lifecycle chain, a clustering analysis and a history of information pertaining to one or more prior security scans, wherein the machine learning model performs the clustering analysis using names of code portions and variables associated with security issues identified in the code from the security scan as central points for clustering;

refining, via the at least one processor, the initial risk factor score to produce an overall risk factor score for the security issue based on a confidence of the initial risk factor score, wherein the initial risk factor score is refined based on one or more risk factor scores for operations within the code applied to a variable of the code portion; and

determining, via the at least one processor, a classification of the security issue as one of a valid security issue and a false positive based on the overall risk factor score.

2 . The method of claim 1 , further comprising:

determining, via a second machine learning model of the at least one processor and at the current stage of the lifecycle chain, a risk weight value for the operation applied to the variable.

3 . The method of claim 2 , wherein the second machine learning model performs clustering based on a name of the code portion and each variable of the code portion.

4 . The method of claim 1 , wherein the initial risk factor score serves as the overall risk factor score in response to the confidence satisfying a threshold.

5 . The method of claim 1 , further comprising: re-training the machine learning model, via the at least one processor, based on the classification and overall risk factor score for the security issue.

6 . The method of claim 1 , further comprising: obtaining the overall risk factor score by applying an exponential weighted average technique to the initial risk factor score and prior risk factor scores generated by the machine learning model.

7 . The method of claim 1 , further comprising: utilizing a lifecycle chain of a problematic variable to calculate the overall risk factor score based on a flow of the problematic variable through corresponding code.

8 . A system for analyzing software for security vulnerabilities comprising:

one or more processors; and

one or more memory devices coupled to the one or more processors, wherein the one or more processors are configured to:

analyze information from a security scan of code to identify a security issue pertaining to a code portion;

determine, via a machine learning model and at a current stage of a lifecycle chain corresponding to a variable associated with the security issue, an initial risk factor score for an operation applied to the variable, wherein the initial risk factor score is determined based at least in part on a risk weight value corresponding to a previous stage of the lifecycle chain, a clustering analysis and a history of information pertaining to one or more prior security scans, wherein the machine learning model performs clustering using names of code portions and variables associated with security issues identified in the code from the security scan as central points for the clustering;

refine the initial risk factor score to produce an overall risk factor score for the security issue based on a confidence of the initial risk factor score, wherein the initial risk factor score is refined based on one or more risk factor scores for operations within the code applied to a variable of the code portion; and

determine a classification of the security issue as one of a valid security issue and a false positive based on the overall risk factor score.

9 . The system of claim 8 , wherein the one or more processors are further configured to:

determine, via a second machine learning model and at the current stage of the lifecycle chain, a risk weight value for the operation applied to the variable.

10 . The system of claim 9 , wherein the second machine learning model performs clustering based on a name of the code portion and each variable of the code portion.

11 . The system of claim 8 , wherein the initial risk factor score serves as the overall risk factor score in response to the confidence satisfying a threshold.

12 . The system of claim 8 , wherein the one or more processors are further configured to:

re-train the machine learning model based on the classification and overall risk factor score for the security issue.

13 . The system of claim 8 , wherein the one or more processors are further configured to:

obtain the overall risk factor score by applying an exponential weighted average technique to the initial risk factor score and prior risk factor scores generated by the machine learning model.

14 . A non-transitory computer-readable medium storing a set of instructions for wireless communication, the set of instructions comprising:

one or more instructions that, when executed by one or more processors of a device, cause the device to:

analyze information from a security scan of code to identify a security issue pertaining to a code portion;

determine, via a machine learning model and at a current stage of a lifecycle chain corresponding to a variable associated with the security issue, an initial risk factor score for an operation applied to the variable, wherein the initial risk factor score is determined based at least in part on a risk weight value corresponding to a previous stage of the lifecycle chain, a clustering analysis and a history of information pertaining to one or more prior security scans, wherein the machine learning model performs clustering using names of code portions and variables associated with security issues identified in the code from the security scan as central points for the clustering;

refine the initial risk factor score to produce an overall risk factor score for the security issue based on a confidence of the initial risk factor score, wherein the initial risk factor score is refined based on one or more risk factor scores for operations within the code applied to a variable of the code portion; and

determine a classification of the security issue as one of a valid security issue and a false positive based on the overall risk factor score.

15 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions cause the device to:

determine, via a second machine learning model and at the current stage of the lifecycle chain, a risk weight value for the operation applied to the variable.

16 . The non-transitory computer-readable medium of claim 15 , wherein the second machine learning model performs clustering based on a name of the code portion and each variable of the code portion.

17 . The non-transitory computer-readable medium of claim 14 , wherein the initial risk factor score serves as the overall risk factor score in response to the confidence satisfying a threshold.

18 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instruction cause the device to:

re-train the machine learning model based on the classification and overall risk factor score for the security issue.

19 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions cause the device to:

obtain the overall risk factor score by applying an exponential weighted average technique to the initial risk factor score and prior risk factor scores generated by the machine learning model.

20 . The non-transitory computer-readable medium of claim 14 , wherein the one or more instructions cause the device to:

utilize a lifecycle chain of a problematic variable to calculate the overall risk factor score based on a flow of the problematic variable through corresponding code.