Search papers, labs, and topics across Lattice.
This paper introduces FP-Predictor, a Graph Convolutional Network (GCN) model that predicts whether Static Application Security Testing (SAST) reports are true or false positives. The model uses Code Property Graphs (CPGs) to represent code structure and semantics derived from static analysis results. Evaluated on CamBenchCAP and CryptoAPI-Bench, FP-Predictor achieved up to 100% and 96.6% accuracy, respectively, and identified potential weaknesses missed by the original SAST tools.
A GCN model trained on static analysis reports can achieve near-perfect accuracy in distinguishing true vulnerabilities from false positives, even uncovering genuine security weaknesses missed by the original SAST tools.
Static Application Security Testing (SAST) tools play a vital role in modern software development by automatically detecting potential vulnerabilities in source code. However, their effectiveness is often limited by a high rate of false positives, which wastes developer's effort and undermines trust in automated analysis. This work presents a Graph Convolutional Network (GCN) model designed to predict SAST reports as true and false positive. The model leverages Code Property Graphs (CPGs) constructed from static analysis results to capture both, structural and semantic relationships within code. Trained on the CamBenchCAP dataset, the model achieved an accuracy of 100% on the test set using an 80/20 train-test split. Evaluation on the CryptoAPI-Bench benchmark further demonstrated the model's practical applicability, reaching an overall accuracy of up to 96.6%. A detailed qualitative inspection revealed that many cases marked as misclassifications corresponded to genuine security weaknesses, indicating that the model effectively reflects conservative, security-aware reasoning. Identified limitations include incomplete control-flow representation due to missing interprocedural connections. Future work will focus on integrating call graphs, applying graph explainability techniques, and extending training data across multiple SAST tools to improve generalization and interpretability.
