Machine Learning Ranking for Static Analysis False Positives
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis tools often produce numerous false positives due to over-approximating program paths, leading to a high volume of unnecessary alerts that human analysts or automation tools must sift through to identify true positives, and existing heavyweight symbolic analysis approaches are slow and unsuitable for large programs or cryptographic computations.
Innovation Solution
A machine learning system that generates probability ratings for vulnerability detections by using a trained model to analyze program slice embedding vectors and register vectors, reducing false positives and improving the efficiency of vulnerability identification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis tools are used to detect vulnerabilities, then vulnerability detection capability is improved, but false positive rate increases
Solution Approach 1:
A machine learning model is introduced as an intermediary between the static analysis tool and the vulnerability reporting system. The static analysis tool generates alerts, which are then processed by the ML model that calculates probability ratings to distinguish true positives from false positives. This intermediary layer resolves the contradiction by maintaining high detection capability while improving precision through probabilistic filtering.
2Reliability
If static analysis tools analyze all program paths, then detection completeness is improved, but processing time increases
Solution Approach 1:
Instead of analyzing all possible program paths exhaustively, the system performs partial analysis by focusing on paths that are most likely to contain vulnerabilities. The machine learning model prioritizes alerts based on probability ratings, allowing the system to process a subset of critical paths first while maintaining detection completeness for high-priority vulnerabilities.
3Measurement precision
If human analysts review all alerts, then accuracy in identifying true positives is improved, but labor cost and time consumption increase
Solution Approach 1:
The system enables self-service by automatically filtering and prioritizing alerts using machine learning probability ratings. Human analysts no longer need to manually review all alerts; instead, they only need to examine high-probability true positives that the system automatically identifies. This reduces both time consumption and labor costs while maintaining high accuracy.
4Measurement precision
If heavyweight symbolic analysis is used, then analysis precision is improved, but system complexity and performance overhead increase
Solution Approach 1:
The patent replaces heavyweight symbolic analysis (a complex mechanical/computational system) with a machine learning-based probabilistic system. Instead of using complex symbolic execution and constraint solving, the system uses trained ML models that process static analysis alerts and generate probability ratings. This substitution maintains analysis precision while significantly reducing system complexity and improving performance.
Data Source
AI summary
A method includes obtaining at least one program slice embedding vector and at least one register vector that are generated based on results from a static analysis tool, the at least one register vector corresponding to the at least one program slice embedding vector. The method also includes using a machine learning model to generate, from the at least one program slice embedding vector and the at least one register vector, at least one probability rating associated with a vulnerability. The method also includes reporting the at least one probability rating for use by the static analysis tool.