empty
empty

### OWASP Benchmark Scorecard for FindBugs v3.0.1

The OWASP Benchmark is a test suite designed to evaluate the speed, coverage, and accuracy of automated vulnerability detection tools. Without the ability to measure these tools, it is difficult to understand their value or interpret vendor claims. The Benchmark contains over 20,000 test cases that are fully runnable and exploitable. The following is the scorecard for the tool FindBugs against version 1.1 of the Benchmark. It shows how well this tool finds true positives and avoids false positives in the Benchmark test cases.

For more information, please visit the OWASP Benchmark Project Site.

## Statistics

Tool elapsed analysis time | 0:06:03
Tool overall score (0-100) | 0.38%
| Total test cases | 21041
Download raw results | Actual Results

## Detailed Results

Category | TP | FN | TN | FP | Total | TPR | FPR | Score
--- | --- | --- | --- | --- | --- | --- | --- | ---
Command Injection | 0 | 1802 | 906 | 0 | 2708 | 0.00% | 0.00% | 0.00%
Cross-Site Scripting | 25 | 1515 | 1907 | 2 | 3449 | 1.62% | 0.10% | 1.52%
Insecure Cookie | 0 | 201 | 215 | 0 | 416 | 0.00% | 0.00% | 0.00%
LDAP Injection | 0 | 521 | 215 | 0 | 736 | 0.00% | 0.00% | 0.00%
Path Traversal | 60 | 1646 | 917 | 7 | 2630 | 3.52% | 0.76% | 2.76%
SQL Injection | 1953 | 344 | 183 | 1049 | 3529 | 85.02% | 85.15% | -0.12%
Trust Boundary Violation | 0 | 505 | 220 | 0 | 725 | 0.00% | 0.00% | 0.00%
Weak Encryption Algorithm | 0 | 720 | 720 | 0 | 1440 | 0.00% | 0.00% | 0.00%
Weak Hash Algorithm | 0 | 714 | 707 | 0 | 1421 | 0.00% | 0.00% | 0.00%
Weak Random Number | 0 | 1612 | 2028 | 0 | 3640 | 0.00% | 0.00% | 0.00%
XPath Injection | 0 | 217 | 130 | 0 | 347 | 0.00% | 0.00% | 0.00%
| Totals | 2038 | 9797 | 8148 | 1058 | 21041 | 8.20% | 7.82% | 0.38%

## Key

True Positive (TP) | Tests with real vulnerabilities that were correctly reported as vulnerable by the tool
False Negative (FN) | Tests with real vulnerabilities that were not correctly reported as vulnerable by the tool
True Negative (TN) | Tests with fake vulnerabilities that were correctly not reported as vulnerable by the tool
False Positive (FP) | Tests with fake vulnerabilities that were incorrectly reported as vulnerable by the tool
True Positive Rate (TPR) = TP / ( TP + FN ) | The rate at which the tool correctly reports real vulnerabilities
False Positive Rate (FPR) = FP / ( FP + TN ) | The rate at which the tool incorrectly reports fake vulnerabilities as real
Score = TPR - FPR | Normalized distance from the random guess line