CLIAMS:We claim:
1. A method for evaluating a source code scanner, the method comprising:
obtaining, by a processor, a source code;
Inserting, by the processor, one or more good code snippets and one or more bad code snippets into the source code to obtain a modified source code;
obtaining, by the processor, an issue list, generated by the source code scanner upon scanning the modified source code, wherein the issue list comprises code segments having security defects identified by the source code scanner, reasons for the security defects, and locations of the security defects in the modified source code;
comparing, by the processor, the code segments, present in the issue list, with the one or more good code snippets and the one or more bad code snippets; and
generating, by the processor, a plurality of metrics, indicating quality of the source code scanner, based on the comparison.

2. The method of claim 1, wherein the one or more good code snippets are free from security defects and the one or more bad code snippets include one or more security defects.

3. The method of claim 1 further comprising determining at least one of control flow and data flow of the source code.

4. The method of claim 3 further comprises inserting the one or more good code snippets and the one or more bad code snippets into the source code based on the at least one of control flow and data flow of the source code.

5. The method of claim 1, wherein the one or more good code snippets and the one or more bad code snippets are inserted randomly in the source code.

6. The method of claim 1, wherein the plurality of metrics comprises a false positive rate and a false negative rate of the source code scanner.

7. An evaluation system for evaluating a source code scanner comprising:
one or more hardware processors; and
a computer-readable medium storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
obtaining a source code;
inserting one or more good code snippets and one or more bad code snippets into the source code to obtain a modified source code;
obtaining an issue list, generated by the source code scanner upon scanning the modified source code, wherein the issue list comprises code segments having security defects identified by the source code scanner, reasons for the security defects, and locations of the security defects in the modified source code;
comparing the code segments, present in the issue list, with the one or more good code snippets and the one or more bad code snippets; and
generating a plurality of metrics, indicating quality of the source code scanner, based on the comparison.

8. The system according to claim 7, wherein the one or more good code snippets are free from security defects and the one or more bad code snippets include one or more security defects.

9. The system according to claim 7, wherein the operations further comprise determining at least one of control flow and data flow of the source code.

10. The system according to claim 9, wherein the operations further comprise inserting the one or more good code snippets and the one or more bad code snippets into the source code based on the at least one of control flow and data flow of the source code.

11. The system according to claim 7, wherein the one or more good code snippets and the one or more bad code snippets are inserted randomly in the source code.

12. The system according to claim 7, wherein the plurality of metrics comprises a false positive rate and a false negative rate of the source code scanner.

13. A non-transitory computer-readable medium storing instructions for evaluating a source code scanner, wherein upon execution of the instructions by one or more hardware processors, the hardware processors perform operations comprising:
obtaining a source code;
inserting one or more good code snippets and one or more bad code snippets into the source code to obtain a modified source code;
obtaining an issue list, generated by the source code scanner upon scanning the modified source code, wherein the issue list comprises code segments having security defects identified by the source code scanner, reasons for the security defects, and locations of the security defects in the modified source code;
comparing the code segments, present in the issue list, with the one or more good code snippets and the one or more bad code snippets; and
generating a plurality of metrics, indicating quality of the source code scanner, based on the comparison.

Dated this 21st day of November, 2014

Swetha S.N
Of K&S Partners
Agent for the Applicant
,TagSPECI:TECHNICAL FIELD
The present subject matter is related, in general to a source code scanner and, in particular, but not exclusively to methods and systems for evaluating a source code scanner.