Page History

...

To calculate CVE match, a model was trained on code samples containing CVEs. For the java model, over 400 CVEs 500 CVEs are covered representing 88 125 different CWEs including, but not limited to, the 18 most common CWEs:

...

...

...

...

...

For the C model, nearly 3,000 CVEs are covered, representing 172 different CWEs including, but not limited to, the 28 most common CWEs:

The diagram below illustrates how DTP, the CVE Match model, and OpenAI embeddings API work together.

...

1. Jtest is configured to send advanced metadata to DTP for machine learning. This setting is disabled by default, but it can be enabled under the Advanced Settings on the Static Analysis Settings tab in your Jtest test configurations. See the Jtest documentation at https://docs.parasoft.com/ for more information.
2. Metrics analysis is run in addition to static analysis and both reports are sent to DTP. During the metrics analysis, one of the following metrics from the Metrics List below must be enabled:

3. METRIC.CLLOCRIM

4. METRIC.NOBLIM

5. METRIC.NOCLIM

6. METRIC.NOLLOCIM

7. METRIC.NOMCIM
8. METRIC.NOPAR

9. METRIC.NOPLIM

10. METRIC.NORET

METRIC.NOSLIM

C/C++test

In order to calculate CVE match for C/C++test violations, metrics analysis must be run in addition to static analysis and both reports must be sent to DTP. During the metrics analysis, one of the following metrics from the Metrics List below must be enabled:.

Metrics List

• METRIC.CC
• METRIC.CLLOCRIM
• METRIC.DIF
• METRIC.ECC
• METRIC.HDIFM
• METRIC.HEFM
• METRIC.HICM
• METRIC.HLENM
• METRIC.HLEVM
• METRIC.HNOBM
• METRIC.HTTPM
• METRIC.HVOCM
• METRIC.HVOLM
• METRIC.MCC
• METRIC.NBD
• METRIC.NOBLIM
• METRIC.NOCLIM
• METRIC.NOLLOCIM
• METRIC.NOMCIM
• METRIC.NOPAR
• METRIC.NOPLIM
• METRIC.NORET
• METRIC.NOSLIM
• METRIC.SCC

...