Learning to Triage Taint Flows Reported by Dynamic Program Analysis in Node.js Packages

Authors: Ronghao Ni, Aidan Z. H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, Kevin Cheang
Published: 2025-10-23

Source: https://arxiv.org/abs/2510.20739

PDF: https://arxiv.org/pdf/2510.20739

AIにより推定されたラベル

脆弱性検出手法 Node.js脆弱性評価 トレーニング手法

※ こちらのラベルはAIによって自動的に追加されました。そのため、正確でないことがあります。
詳細は文献データベースについてをご覧ください。

Abstract

Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNN and LLMs, trained on data based on a dynamic program analysis tool’s output. The top LLM achieves F₁ = 0.915, while the best GNN and classical ML models reaching F₁ = 0.904. At a less than 7 model eliminates 66.9 ms per package. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20 detect 99.2 strong potential for real-world vulnerability triage.