Post details algorithmic generation of false-positive alert filters
FP-Growth ranks field combinations from a detection rule's context and offers analysts the top three candidate filters.
Stories per day · 30 days
2 RSS
Relatedagentdojo2agent-security2llm-guards2alert-filtering1audio1backward-compatibility1benchmark1c-cpp1detection-rules1detector1embedder1fp-growth1intrusion-detection1kaissar-corpus1metasploit1modules1multilingual1neural-watermark1
13 stories, newest first · one card per story
Stories tagged #false-positives
Secondary analysis finds detection trade-offs in quantum ML intrusion detection
In one comparison a quantum SVM lowers false positives from 6.875% to 3.329% while true positives dip slightly.
Tool-call guards fail when actions are rendered as shell commands
Four of five specialized guards raise AgentDojo false-positive rates by 21 to 47 points under shell form.
Addresses some false positives in several modules
Metasploit commit reduces false positives across several modules.
VulnSAGE checks LLM judgments of SAST reports against program structure
On 187 labeled reports it rejected 89 of 97 false alarms and kept 85 of 90 real defects.
Backward Compatibility in Zero-Bit Neural Audio Watermarking
Legacy-chain training plus angular diversity loss makes neural audio watermarks backward compatible.
Language Is a Security Surface for Agent Guards
Most smaller agent guards change safety verdicts when requests are translated, especially into rarer languages.
Case-Level Verification in Scanner-LLM Cascades: Overcoming the Alert Aggregation Bottleneck to Expand the FRR-TPR Trade-off Space
Case-level LLM checks of DAST alerts improve false-positive reduction past the alert-aggregation bottleneck.
PIDS-Bench: Evaluating Prompt-Injection Detectors Under Over-Defense, Obfuscation, and Distribution Shift
PIDS-Bench shows prompt-injection detectors scoring F1 above 0.98 still misclassify about one-third of external benign security-adjacent prompts, revealing provenance-sensitive over-defense.
AWS puts AI vulnerability detection to the test, and false positives pile up
AWS publicly released its Deception Benchmark (14,822 samples) showing leading AI models falsely flag 41-99% of safe code as vulnerable.
3
When the Whole Company Adopts AI: What It Does to Your SOC
Analysis of 16.9 million SOC alerts finds AI-related alerts at 0.43%, growing 685% since February, with 94.1% noise and 0.02% real attacks.
4
Rare Not Random Using Token Efficiency for Secrets Scanning
Researcher proposes token efficiency (string length divided by BPE token count) as a better post-regex filter than entropy for secrets scanning, validated on CredData.
2
An Empirical Analysis of CodeQL False Positives and Query Refinements for Java Vulnerabilities
Study of 167 Java CVE instances finds CodeQL false positives follow recurring patterns; query refinements remove 81.8% of reviewed ones.