Learning to Triage Taint Flows Reported by Dynamic Program Analysis in Node.js Packages

Authors: Ronghao Ni, Aidan Z. H. Yang, Min-Chien Hsu, Nuno Sabino, Limin Jia, Ruben Martins, Darion Cassel, Kevin Cheang
Published: 2025-10-23

Source: https://arxiv.org/abs/2510.20739

PDF: https://arxiv.org/pdf/2510.20739

Labels Predicted by AI

Training Method

Please note that these labels were automatically added by AI. Therefore, they may not be entirely accurate.
For more details, please see the About the Literature Database page.

Abstract

Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNN and LLMs, trained on data based on a dynamic program analysis tool’s output. The top LLM achieves F₁ = 0.915, while the best GNN and classical ML models reaching F₁ = 0.904. At a less than 7 model eliminates 66.9 ms per package. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20 detect 99.2 strong potential for real-world vulnerability triage.