Classifier Training for Static Security Analysis False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis tools generate a high number of false positives due to their imprecision in identifying vulnerabilities, as they operate on abstract representations of programs to avoid state-space explosion, leading to potential infinite states, and this results in many web applications being incorrectly flagged as vulnerable.
Innovation Solution
A method for training classifiers that involves running initial security analyses on a training codebase, analyzing programs with feature sets that limit detected vulnerabilities, comparing these to known vulnerability distributions to generate accuracy scores, and iteratively refining the feature sets to find the highest accuracy score, thereby generating a classifier that suppresses false positives by converging on a distribution of 'true' vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If abstract representations are used in static analysis, then the analysis becomes tractable and avoids state-space explosion, but the precision deteriorates leading to false positives
Solution Approach 1:
The patent applies preliminary action by pre-training a classifier on a large codebase before deploying it for vulnerability detection. The classifier is trained in advance on a training codebase to learn the distribution of true vulnerabilities, enabling it to filter false positives during actual analysis without compromising the tractability of abstract static analysis
Solution Approach 2:
The patent implements feedback by using the trained classifier to evaluate vulnerability detections and generate feedback signals. The classifier provides feedback on whether detected vulnerabilities are likely true positives or false positives based on learned patterns, allowing the system to iteratively improve detection accuracy while maintaining analysis efficiency
2Quantity of substance
If comprehensive vulnerability detection is performed, then more vulnerabilities are identified, but the number of false positives increases prohibitively
Solution Approach 1:
The patent applies segmentation by dividing the vulnerability detection process into two distinct stages: (1) initial comprehensive detection using abstract static analysis to identify all potential vulnerabilities, and (2) filtering stage using the trained classifier to separate true positives from false positives. This segmentation allows comprehensive detection while eliminating the reliability problem of false positives
Solution Approach 2:
The trained classifier serves as an intermediary between the abstract static analysis and the final vulnerability report. It mediates by evaluating each detected vulnerability against learned patterns from the training codebase, allowing the system to maintain comprehensive detection capability while filtering out false positives before reporting results
Data Source
AI summary
Methods for training a static security analysis classifier include running an initial security analysis on a training codebase to generate a set of vulnerabilities associated with the training codebase; analyzing the program with a feature set that limits a number of detected vulnerabilities to generate a limited set of vulnerabilities associated with the feature set; comparing the limited set of vulnerabilities to a known vulnerability distribution to generate an accuracy score; and iterating the steps of analyzing and comparing using different feature sets to find a feature set having a highest accuracy score.