IntelliSA: An Intelligent Static Analyzer for IaC Security Smell Detection Using Symbolic Rules and Neural Inference
Qiyue Mei, Michael Fu

TL;DR
IntelliSA is an innovative static analysis tool that combines symbolic rules and neural inference, using knowledge distillation to efficiently detect security smells in Infrastructure as Code scripts with high accuracy and low false positives.
Contribution
This paper introduces IntelliSA, a novel hybrid static analyzer that integrates symbolic rules with neural inference via knowledge distillation, improving detection accuracy and efficiency for IaC security smells.
Findings
Achieves 83% F1 score, outperforming baselines by 7-42%.
Detects 60% of security smells while inspecting less than 2% of code.
Uses a compact student model trained via pseudo-labels from an LLM teacher.
Abstract
Infrastructure as Code (IaC) enables automated provisioning of large-scale cloud and on-premise environments, reducing the need for repetitive manual setup. However, this automation is a double-edged sword: a single misconfiguration in IaC scripts can propagate widely, leading to severe system downtime and security risks. Prior studies have shown that IaC scripts often contain security smells--bad coding patterns that may introduce vulnerabilities--and have proposed static analyzers based on symbolic rules to detect them. Yet, our preliminary analysis reveals that rule-based detection alone tends to over-approximate, producing excessive false positives and increasing the burden of manual inspection. In this paper, we present IntelliSA, an intelligent static analyzer for IaC security smell detection that integrates symbolic rules with neural inference. IntelliSA applies symbolic rules to…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsAdvanced Malware Detection Techniques · Security and Verification in Computing · Web Application Security Vulnerabilities
