FP-Predictor - False Positive Prediction for Static Analysis Reports

TL;DR

This paper introduces FP-Predictor, a GCN-based model that predicts the validity of static analysis reports, significantly reducing false positives and improving trust in SAST tools.

Contribution

The work presents a novel GCN model utilizing Code Property Graphs to accurately classify SAST reports as true or false positives, with high accuracy on multiple benchmarks.

Findings

Achieved 100% accuracy on CamBenchCAP dataset

Reached up to 96.6% accuracy on CryptoAPI-Bench

Model reflects security-aware reasoning in classifications

Abstract

Static Application Security Testing (SAST) tools play a vital role in modern software development by automatically detecting potential vulnerabilities in source code. However, their effectiveness is often limited by a high rate of false positives, which wastes developer's effort and undermines trust in automated analysis. This work presents a Graph Convolutional Network (GCN) model designed to predict SAST reports as true and false positive. The model leverages Code Property Graphs (CPGs) constructed from static analysis results to capture both, structural and semantic relationships within code. Trained on the CamBenchCAP dataset, the model achieved an accuracy of 100% on the test set using an 80/20 train-test split. Evaluation on the CryptoAPI-Bench benchmark further demonstrated the model's practical applicability, reaching an overall accuracy of up to 96.6%. A detailed qualitative inspection revealed that many cases marked as misclassifications corresponded to genuine security weaknesses, indicating that the model effectively reflects conservative, security-aware reasoning. Identified limitations include incomplete control-flow representation due to missing interprocedural connections. Future work will focus on integrating call graphs, applying graph explainability techniques, and extending training data across multiple SAST tools to improve generalization and interpretability.