On establishing a benchmark for evaluating static analysis alert prioritization and classification techniques