Refining a machine learning model for calculating confidence scores associated with potential security vulnerabilities
Various embodiments include systems and methods of implementing a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities. In some embodiments, the ML model may be used to determine a confidence score for a particular potential security vulnerability. According to some embodiments, input indicative of a change of verification status for the particular potential security vulnerability may be received via a vulnerability details graphical user interface. Responsive to determining that the confidence score generated by the ML model is inconsistent with the change of verification status, the change of verification status may be sent as analyst feedback data to one or model training components of the ML model. The model training component(s) may be utilized to refine the ML model based at least in part on the analyst feedback data.
1 . A system, comprising:
one or more hardware processors with associated memory that implement a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities detected via application security testing of an application accessible over a network, wherein the one or more hardware processors are configured to:
obtain scan traffic data associated with a particular scan finding generated by one or more scan engines that a particular potential security vulnerability is detected in the application during application security testing based on the scan traffic data, wherein the scan traffic data is generated as a result of one or more requests sent to the application over the network and includes one or more responses of the application received over the network in response to the one or more requests;
use the ML model to evaluate the scan traffic data and generate a confidence score for the particular scan finding, wherein the ML model is trained using training data that includes (a) previous scan traffic data for the application, (b) previous scan findings indicating different previous detections of potential security vulnerabilities in the application based on the previous scan traffic data, and (c) labels reflecting previous analyst determinations of whether individual ones of the previous detections of potential security vulnerabilities were true positives or false positives after manual investigation of the previous scan findings;
generate a vulnerability analysis graphical user interface that displays a list of scan findings indicating potential security vulnerabilities in the application detected by the one or more scan engines, wherein the list is ranked based on respective confidence scores and severity levels of the potential security vulnerabilities;
responsive to a selection of the particular potential security vulnerability via the vulnerability analysis graphical user interface, generate a vulnerability details graphical user interface that contains vulnerability information including the confidence score generated by the ML model for the particular potential security vulnerability and the severity score of the particular potential security vulnerability;
receive, via the vulnerability details graphical user interface, input indicative of a change of verification status for the particular potential security vulnerability;
responsive to determining that the confidence score generated by the ML model is inconsistent with the change of verification status, send the change of verification status as analyst feedback data to one or more model training components of the ML model; and
utilize the one or more model training components to refine the ML model based at least in part on the analyst feedback data, including to perform additional training of the ML model using the analyst feedback data.
2 . The system of claim 1 , wherein the one or more hardware processors are configured to:
responsive to user input received via the vulnerability analysis graphical user interface, sort or filter the list of scan findings indicating potential security vulnerabilities in the application based on the respective confidence scores and severity levels of the potential security vulnerabilities.
3 . The system of claim 1 , wherein the confidence score generated by the ML model for the particular potential security vulnerability corresponds to a percentage value within a range of zero percent to one-hundred percent.
4 . The system of claim 1 , wherein the ML model is retrained based on additional training data on a weekly, fortnightly, or monthly basis.
5 . The system of claim 1 , wherein the ML model is retrained based on additional training data when a sufficient number of scan findings have been reviewed by security analysts.
6 . The system of claim 1 , wherein:
the vulnerability details graphical user interface includes a selectable option to change the verification status of the particular potential security vulnerability to identify the particular potential security vulnerability as a true positive; and
the change of verification status is sent as analyst feedback data to the one or more model training components of the ML model responsive to determining that the confidence score is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a false positive.
7 . The system of claim 6 , wherein the confidence score for the particular potential security vulnerability corresponds to a percentage value that is less than fifty percent.
8 . The system of claim 6 , wherein the one or more hardware processors are configured to generate an alert to notify an analyst that the confidence score is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a false positive prior to sending the change of verification status as analyst feedback data.
9 . The system of claim 1 , wherein:
the vulnerability details graphical user interface includes a selectable option to change the verification status of the particular potential security vulnerability to identify the particular potential security vulnerability as a false positive; and
the change of verification status is sent as analyst feedback data to the one or more model training components of the ML model responsive to determining that the confidence score is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a true positive.
10 . The system of claim 9 , wherein the confidence score for the particular potential security vulnerability corresponds to a percentage value that is at least fifty percent.
11 . A method comprising:
implementing, using one or more hardware processors, a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities detected via application security testing of an application accessible over a network, wherein the implementing comprises:
obtaining scan traffic data associated with a particular scan finding generated by one or more scan engines that a particular potential security vulnerability is detected in the application during application security testing based on the scan traffic data, wherein the scan traffic data is generated as a result of one or more requests sent to the application over the network and includes one or more responses of the application received over the network in response to the one or more requests;
using the ML model to evaluate the scan traffic data and generate a confidence score for the particular scan finding, wherein the ML model is trained using training data that includes (a) previous scan traffic data for the application, (b) previous scan findings indicating different previous detections of potential security vulnerabilities in the application based on the previous scan traffic data, and (c) labels reflecting previous analyst determinations of whether individual ones of the previous detections of potential security vulnerabilities were true positives or false positives after manual investigation of the previous scan findings;
generating a vulnerability analysis graphical user interface that displays a list of scan findings indicating potential security vulnerabilities in the application detected by the one or more scan engines, wherein the list is ranked based on respective confidence scores and severity levels of the potential security vulnerabilities;
responsive to a selection of the particular potential security vulnerability via the vulnerability analysis graphical user interface, generating a vulnerability details graphical user interface that contains vulnerability information including the confidence score generated by the ML model for the particular potential security vulnerability and the severity score of the particular potential security vulnerability;
receiving, via the vulnerability details graphical user interface, input indicative of a change of verification status for the particular potential security vulnerability;
responsive to determining that the confidence score generated by the ML model is inconsistent with the change of verification status, sending the change of verification status as analyst feedback data to one or more model training components of the ML model; and
utilizing the one or more model training components to refine the ML model based at least in part on the analyst feedback data, including performing additional training of the ML model using the analyst feedback data.
12 . The method of claim 11 , wherein the method further comprises:
monitoring a performance metric of the one or more scan engines, wherein the performance metrics is based on the confidence score; and
responsive to a determination that the performance metric has dropped below a threshold, generating a message indicating to update the one or more scan engines or a regular expression pattern used by the one or more scan engines to detect the particular potential security vulnerability.
13 . The method of claim 11 , wherein:
the confidence score generated by the ML model for the particular potential security vulnerability corresponds to a percentage value within a range of zero percent to one-hundred percent;
the confidence score having a percentage value of zero percent is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a false positive; and
the confidence score having a percentage value of one-hundred percent is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a true positive.
14 . The method of claim 11 , wherein:
the vulnerability details graphical user interface includes a selectable option to change the verification status of the particular potential security vulnerability to identify the particular potential security vulnerability as a true positive; and
the change of verification status is sent as analyst feedback data to the one or more model training components of the ML model responsive to determining that the confidence score is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a false positive based at least in part on the confidence score corresponding to a percentage value that is less than fifty percent.
15 . The method of claim 14 , wherein the method further comprises generating an alert to notify an analyst that the confidence score is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a false positive prior to sending the change of verification status as analyst feedback data.
16 . The method of claim 11 , wherein:
the vulnerability details graphical user interface includes a selectable option to change the verification status of the particular potential security vulnerability to identify the particular potential security vulnerability as a false positive; and
the change of verification status is sent as analyst feedback data to the one or more model training components of the ML model responsive to determining that the confidence score is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a true positive based at least in part on the confidence score corresponding to a percentage value that is at least fifty percent.
17 . One or more non-transitory computer-accessible storage media storing program instructions that, when executed on or across one or more processors, implement at least a portion of a system that implements a machine learning (ML) model for calculating confidence scores associated with potential security vulnerabilities detected via application security testing of an application accessible over a network and cause the system to:
obtain scan traffic data associated with a particular scan finding generated by one or more scan engines that a particular potential security vulnerability is detected in the application during application security testing based on the scan traffic data, wherein the scan traffic data is generated as a result of one or more requests sent to the application over the network and includes one or more responses of the application received over the network in response to the one or more requests;
use the ML model to evaluate the scan traffic data and generate a confidence score for the particular scan finding, wherein the ML model is trained using training data that includes (a) previous scan traffic data for the application, (b) previous scan findings indicating different previous detections of potential security vulnerabilities in the application based on the previous scan traffic data, and (c) labels reflecting previous analyst determinations of whether individual ones of the previous detections of potential security vulnerabilities were true positives or false positives after manual investigation of the previous scan findings;
generate a vulnerability analysis graphical user interface that displays a list of scan findings indicating potential security vulnerabilities in the application detected by the one or more scan engines, wherein the list is ranked based on respective confidence scores and severity levels of the potential security vulnerabilities;
responsive to a selection of the particular potential security vulnerability via the vulnerability analysis graphical user interface, generate a vulnerability details graphical user interface that contains vulnerability information including the confidence score generated by the ML model for the particular potential security vulnerability and the severity score of the particular potential security vulnerability;
receive, via the vulnerability details graphical user interface, input indicative of a change of verification status for the particular potential security vulnerability;
responsive to determining that the confidence score generated by the ML model is inconsistent with the change of verification status, send the change of verification status as analyst feedback data to one or more model training components of the ML model; and
utilize the one or more model training components to refine the ML model based at least in part on the analyst feedback data, including to perform additional training of the ML model using the analyst feedback data.
18 . The one or more non-transitory computer-accessible storage media of claim 17 , wherein the program instructions when executed on or across one or more processors cause the system to:
responsive to user input received via the vulnerability analysis graphical user interface, sort or filter the list of scan findings indicating potential security vulnerabilities in the application based on the respective confidence scores and severity levels of the potential security vulnerabilities.
19 . The one or more non-transitory computer-accessible storage media of claim 17 , wherein:
the application security testing simulates an attack on the application to exploit the particular potential security vulnerability; and
the vulnerability details graphical user interface includes a selectable option to replay the attack, wherein the analyst feedback is generated based on a result of the replay.
20 . The one or more non-transitory computer-accessible storage media of claim 17 , wherein:
the vulnerability details graphical user interface includes a selectable option to change the verification status of the particular potential security vulnerability to identify the particular potential security vulnerability as a false positive; and
the change of verification status is sent as analyst feedback data to the one or more model training components of the ML model responsive to determining that the confidence score corresponds to a percentage value that is at least fifty percent which is indicative of the ML model having determined that the particular potential security vulnerability is most likely to be a true positive based at least in part on the confidence score corresponding to a percentage value that is at least fifty percent.