Search papers, labs, and topics across Lattice.
This paper introduces Memoir, a memory-driven framework designed to enhance the accuracy of Static Application Security Testing (SAST) tools by transforming historical false-positive alerts into reusable semantic memories. By utilizing LLM-guided annotation and pattern clustering, Memoir constructs a structured memory that evolves as new validated cases are incorporated, effectively addressing the challenges of static knowledge and variability among SAST tools. The framework demonstrates exceptional performance, achieving an F1-score of 99.43% and perfect precision in real-world evaluations, significantly reducing manual inspection costs and increasing developer trust.
Memoir's innovative memory-driven approach reduces false-positive alerts in SAST tools to near perfection, revolutionizing the way security testing can be performed.
Static Application Security Testing (SAST) tools have become indispensable in modern secure software devel- opment. However, these tools often generate false-positive (FP) alerts, imposing substantial manual inspection costs and reducing the trust from developers. Existing FP reduction methods still face two primary challenges. First, the large differences among SAST tools and vulnerability categories make it difficult for these methods to learn recurring patterns in historical false positives. Moreover, the knowledge used by these methods are largely static and cannot be updated as newly validated cases accumulate. To address these challenges, we propose Memoir, a memory- driven framework for identifying false positives by transform- ing historical FP alerts into reusable semantic memories. It consists of two key modules. First, historical semantic memory construction converts historical FP alerts into structured semantic memories through LLM-guided annotation, pattern clustering, and memory synthesis to capture reusable behavioral patterns. Moreover, memory-driven identification and evolution retrieves relevant memories and performs semantic verification against taxonomy consistency and security invariants before making the final prediction. It then incorporates verified predictions back into the memory repository, allowing the knowledge base to evolve as new cases accumulate. We evaluate Memoir on CWE- Bench-Java to demonstrate its effectiveness in real-world security analysis. Specifically, Memoir achieves an F1-score of 99.43% with a Recall of 98.88% and perfect Precision, consistently outperforming other baselines. Furthermore, an industrial case study on production software systems from a top IT company shows that the learned memory base generalizes effectively across different SAST tools without retraining.
