false positive analysis

Traditional rule-based Cloud Security Posture Management (CSPM) suffers from high false-positive rates due to limited contextual awareness and static detection mechanisms. To address this, we propose a verification-driven, proactive behavioral analysis method: lightweight, automated probes—integrating open-source tools, custom validation scripts, and penetration testing scenarios—dynamically simulate attack paths at runtime to assess the exploitability of policy violations, thereby distinguishing genuine risks from false positives. The approach employs a modular architecture natively supporting multi-cloud environments without impacting production systems. Evaluated in a reproducible AWS testbed, our method reduces average false-positive rates for misconfiguration- and vulnerability-related alerts by 93%, while maintaining low response latency. This significantly enhances CSPM accuracy, operational utility, and scalability.

This work addresses the high false-positive rate and insufficient precision and automation in program bug detection. We propose a bidirectional collaborative analysis framework integrating Incorrectness Logic (IL) and Sufficient Incorrectness Logic (SIL). Our approach introduces a rule-level guidance mechanism that dynamically steers subsequent reasoning using prior analysis results, coupled with path pruning, loop unrolling, and dynamic instrumentation of proof rules to enable cross-logic information reuse. The method significantly improves joint accuracy in error reachability verification and fault-triggering input reconstruction while preserving scalability and enhancing industrial applicability. Experimental evaluation demonstrates substantial improvements over single-logic approaches in three key dimensions: (i) bug localization accuracy, (ii) causal explainability of defects, and (iii) efficiency of automated analysis. Our framework establishes a novel paradigm for scalable, automated code contract generation.

This work addresses the overwhelming volume of alerts generated by static analysis tools, which often exceeds human review capacity. To tackle this challenge, the authors propose an automated triage approach leveraging large language models (LLMs), integrating consistency checking (CC) with LLM-based reasoning evaluation (LRE) to substantially reduce false positives. The method further incorporates dynamic triggering to validate the exploitability of reported vulnerabilities. Evaluated on medium-scale LLMs—including o4-mini and gpt-oss-120b—across the Juliet, FormAI, and SV-COMP benchmarks, the approach achieves a recall of at least 98% and a specificity of no less than 94.8%, demonstrating significantly improved triage accuracy and generalization capability.

This work addresses the critical vulnerability of Software-Defined Networking (SDN) controllers in Wide Area Networks (WANs) to severe outages caused by erroneous inputs, such as those stemming from control-plane bugs. To mitigate this risk, the authors introduce input validation as a dedicated defense layer within the WAN control plane, deploying a lightweight validation mechanism ahead of the controller to detect and block invalid inputs in real time. The system employs a shadow deployment architecture that combines simulation with live production data, exhibiting strong robustness against noisy, missing, or corrupted telemetry. During a four-week production deployment, it accurately captured the sole instance of invalid input with zero false positives. Simulations further demonstrate 100% detection of traffic anomalies as small as 5% and sustained zero false positives even under up to 30% telemetry corruption.

Static error detection in large codebases suffers from high false-positive rates due to insufficient path feasibility analysis—especially for multi-branch and interprocedural complex dependencies. To address this, we propose LLM4PFA, the first agent-planning-driven, context-aware path feasibility analysis framework. It integrates LLM-based agents, constraint-cascading reasoning, dynamic context extraction, and iterative symbolic pruning to precisely identify infeasible paths. Unlike conventional static analyzers, LLM4PFA overcomes fundamental limitations in constraint propagation and scalability. Evaluated on real-world projects, LLM4PFA reduces false positives by 72%–96%, outperforming the best baseline by 41.1%–105.7%. It achieves high precision with only three missed true vulnerabilities among 45 confirmed positives. This substantial improvement enhances both the accuracy and practical utility of vulnerability detection in industrial-scale codebases.

This work addresses the challenge of manually responding to the overwhelming volume of CVE vulnerabilities by proposing an automated approach for generating web vulnerability detection rules using large language models (LLMs). The method parses Nuclei templates and integrates structured and unstructured data to produce high-precision JSON-based detection rules. It employs an innovative “LLM-as-a-judge” confidence validation framework combined with a 5×5 generation strategy, and incorporates a human-in-the-loop feedback loop to continuously refine rule quality. Experimental results demonstrate that the system reduces false positive rates by 67% in production environments and achieves an AUROC of 0.75 for rule validation, significantly enhancing both the accuracy and efficiency of large-scale vulnerability detection.

This work addresses the diagnostic opacity of eBPF verifier rejections, which often manifest as vague errors—such as EINVAL in 47% of cases—making root cause identification challenging. The study presents the first systematic characterization of this diagnostic gap and introduces bpfix, a novel tool that reconstructs the location of proof loss from verifier logs and leverages program semantics to precisely pinpoint the underlying cause. bpfix generates clear, Rust-style diagnostic messages to aid developers. Additionally, the authors construct the first benchmark dataset of eBVF verification failures tailored for LLM-based repair. Empirical evaluation demonstrates that integrating bpfix improves the repair success rate of large language models by 11–21 percentage points, with 10 out of 12 identified root causes being unique to eBPF.

This study addresses the significant challenge posed by a high volume of false-positive defect reports in Linux kernel development, which severely hinders the timely resolution of genuine issues. It presents the first systematic empirical investigation into false-positive kernel defects, introducing a manually annotated dataset of 2,006 reports. The work analyzes the root causes of these misclassifications and proposes a novel approach leveraging retrieval-augmented generation (RAG) with large language models to automatically identify false positives. Experimental results demonstrate that the proposed method achieves a recall of 91% and an F1 score of 88% on the false-positive identification task, substantially improving triage efficiency. This research offers a practical and effective technical pathway for managing defect reports in open-source software ecosystems.

Large language models can generate runnable software artifacts, but their security remains difficult to evaluate end to end. This study examines that problem through a Detect--Repair--Verify (DRV) workflow, in which vulnerabilities are detected, repaired, and then rechecked with security and functional tests. It addresses four gaps in current evidence: the lack of test-grounded benchmarks for LLM-generated artifacts, limited evidence on pipeline-level effectiveness, unclear reliability of detection reports as repair guidance, and uncertain repair trustworthiness under verification. To support this study, EduCollab is constructed as a multi-language, multi-granularity benchmark of runnable LLM-generated web applications in PHP, JavaScript, and Python. Each artifact is paired with executable functional and exploit test suites, and the benchmark spans project-, requirement-, and file-level settings. On this benchmark, the study compares unrepaired baselines, single-pass detect--repair, and bounded iterative DRV under comparable budget constraints. Outcomes are measured by secure-and-correct yield, and intermediate artifacts and iteration traces are analyzed to assess report actionability and repair failure modes. The results show that bounded iterative DRV can improve secure-and-correct yield over single-pass repair, but the gains are uneven at the project level and become clearer at narrower repair scopes. Detection reports are often useful for downstream repair, but their reliability is inconsistent. Repair trustworthiness also depends strongly on repair scope. These findings highlight the need for test-grounded, end-to-end evaluation of LLM-based vulnerability management workflows.

This study addresses the persistent occurrence of user-visible defects in production despite passing automated tests, particularly in complex scenarios involving large language model ensembles, multi-market internationalization, and browser-based front-end compositions. To tackle this issue, the authors propose a “four-seam” defect escape analysis framework. Through root cause analysis of 252 defect-fixing commits, they identify that 44% of defects originate from four critical verification blind spots: real-browser runtime environments, non-default markets, end-to-end user workflows, and full-system integration levels. Building on these insights, the team developed an automated test suite encompassing 1,553 test cases and introduced an actionable method for prioritizing boundary testing. This approach significantly reduces the recurrence of similar defects in production deployments and effectively compensates for the coverage limitations of conventional unit testing.