Learning to Triage Taint Flows Reported by Dynamic Program Analysis in Node.js Packages

2025/10/23 by Ronghao Ni, Ni, Ronghao, Aidan Z. H. Yang +12
Computer Science · #Web Application Security Vulnerabilities #Security and Verification in Computing #Advanced Malware Detection Techniques

paper · pdf · doi:10.48550/arxiv.2510.20739

Abstract

Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNN and LLMs, trained on data based on a dynamic program analysis tool's output. The top LLM achieves F₁ = 0.915, while the best GNN and classical ML models reaching F₁ = 0.904. At a less than 7% false-negative rate, the leading model eliminates 66.9% of benign packages from manual review, taking around 60 ms per package. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives amongst all warnings), our approach can detect 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage.

Citations

• Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities
• DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning
• Qwen2.5 Technical Report
• The Llama 3 Herd of Models
• Security Vulnerability Detection with Multitask Self-Instructed Fine-Tuning of Large Language Models
• GRACE: Empowering LLM-based software vulnerability detection with graph structure and in-context learning
• Large Language Models for Test-Free Fault Localization
• QLoRA: Efficient Finetuning of Quantized LLMs
• GPT-4 Technical Report
• Towards Reasoning in Large Language Models: A Survey
• Dataflow Analysis-Inspired Deep Learning for Efficient Vulnerability Detection
• LineVD: Statement-level Vulnerability Detection using Graph Neural Networks
• BNAI, NO-TOKEN, and MIND-UNITY: Pillars of a Systemic Revolution in Artificial Intelligence
• LoRA: Low-Rank Adaptation of Large Language Models
• Deep Learning based Vulnerability Detection: Are We There Yet?
• Devign: Effective Vulnerability Identification by Learning Comprehensive Program Semantics via Graph Neural Networks
• Neutaint: Efficient Dynamic Taint Analysis with Neural Networks
• An Empirical Study of Information Flows in Real-World JavaScript
• Fast Graph Representation Learning with PyTorch Geometric
• The Art, Science, and Engineering of Fuzzing: A Survey
• Automated Vulnerability Detection in Source Code Using Deep Representation Learning
• A Unified Approach to Interpreting Model Predictions
• Gated Graph Sequence Neural Networks
• Mitigating program security vulnerabilities
• A Coefficient of Agreement for Nominal Scales

Related

• Security Vulnerability Detection with Multitask Self-Instructed Fine-Tuning of Large Language Models
• Detecting Code Vulnerabilities with Heterogeneous GNN Training
• Profile of Vulnerability Remediations in Dependencies Using Graph Analysis
• Explaining the Contributing Factors for Vulnerability Detection in Machine Learning
• Predicting sensitive information leakage in IoT applications using flows-aware machine learning approach