# Utilizing Precise and Complete Code Context to Guide LLM in Automatic False Positive Mitigation

**Authors:** Jinbao Chen, Hongjing Xiang, Luhao Li, Yu Zhang, Boyao Ding, Qingwei Li  
**arXiv:** [2411.03079](https://arxiv.org/abs/2411.03079)  
**Date:** 2024-11-05  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2411.03079v1/

## Key points

- Static application security testing (SAST) tools are crucial for detecting bugs early on and ensuring code quality in software development.
- Common issue of false positives in SAST tools can slow down the development process.
- Automating false positive mitigation is essential to enhance the effectiveness of SAST tools.
- Large Language Models (LLMs) show potential to improve accuracy and usability of SAST tools, but face shortcomings in extracting precise and complete code context.
- Novel approach named LLM4FPM proposed to address these shortcomings by incorporating eCPG-Slicer for line-level precise code context extraction and FARF algorithm for efficient file reference graph construction.
- LLM4FPM demonstrated superior performance compared to baseline methods with an F1 score exceeding 99% across various Common Weakness Enumerations (CWEs).
- LLM4FPM leverages a free open-source model, reducing inspection costs by up to $2758 per run on Juliet dataset with an average inspection time of 4.7 seconds per warning.
- Importance of leveraging precise and complete code context highlighted for effective bug detection and improved code quality in software development processes.

## Summary

, , , , 

In the realm of software development, static application security testing (SAST) tools are crucial for detecting bugs early on and ensuring code quality. However, these tools often encounter a common issue of generating false positives, which can significantly slow down the development process. To address this challenge and enhance the effectiveness of SAST tools, automating false positive mitigation becomes essential. Previous attempts at mitigating false positives have involved utilizing static/dynamic analysis or machine learning techniques. With the emergence of Large Language Models (LLMs) that excel in understanding both natural language and code, there is newfound potential to improve the accuracy and usability of SAST tools. Despite this promise, existing LLM-based methods face shortcomings in two key areas. Firstly, when extracting code snippets related to warnings, these snippets tend to be cluttered with irrelevant control and data flows, leading to reduced precision. Secondly, critical code contexts are often omitted from these extractions, resulting in incomplete representations that can mislead LLMs and lead to inaccurate assessments. To ensure precise and complete code context is utilized effectively to guide LLMs in automatic false positive mitigation, a novel approach named LLM4FPM is proposed. This innovative methodology incorporates eCPG-Slicer as one of its core components, which constructs an extended code property graph and extracts line-level precise code context. Additionally, LLM4FPM integrates the FARF algorithm to build a file reference graph efficiently detect all files related to a warning in linear time. This enables eCPG-Slicer to gather comprehensive code context across these identified files. The efficacy of LLM4FPM was evaluated using the Juliet dataset where it demonstrated superior performance compared to baseline methods by achieving an F1 score exceeding 99% across various Common Weakness Enumerations (CWEs). Notably, LLM4FPM leverages a free open-source model which not only avoids costly alternatives but also reduces inspection costs by up to $2758 per run on Juliet dataset with an average inspection time of 4.7 seconds per warning. This groundbreaking work underscores the critical importance of leveraging precise and complete code context while highlighting the immense potential that arises from combining program analysis with Large Language Models. By enhancing both the quality and efficiency of software development processes through such innovative approaches like LLM4FPM, strides towards more effective bug detection and improved code quality can be achieved within the software development landscape.