SShortSingh.
Back to feed

Undergraduate Thesis Uses Paraconsistent Logic to Eliminate AppSec False Positives

0
·3 views

A software engineering undergraduate developed a security alert triage system using Two-valued Paraconsistent Annotated Logic (LPA2v) to address alert fatigue in application security pipelines. Instead of forcing contradictory scanner outputs into a binary verdict, the system assigns each finding two evidence degrees — favorable and unfavorable — allowing genuine contradictions to be flagged separately for human review. Five domain-specific neurons process signals from SAST, SCA, and DAST tools, feeding into a master neuron that separately aggregates consensus severity and contradiction levels. Tested against 3,005 synthetic events, the LPA2v cluster achieved 100% precision and zero false positives, compared to 8% precision and 2,493 false positives from a plain threshold approach. The trade-off was a recall drop to 65.6%, with missed detections concentrated in single-source evidence scenarios and cases affected by the system's temporal persistence window.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Developer warns AI 'verification' is unreliable after flawed code copy goes undetected

A developer building a second app attempted to replicate a working podcast production pipeline by asking an AI assistant to copy it, then used a separate AI session to verify the result. The fresh session had no context of the original pipeline and confirmed the code looked correct, despite significant production flaws in timing, music fading, and voice settings. The errors only surfaced when the developer ran a real transcript through the new pipeline. The author argues the problem is not blind trust in AI, but mistaking proxy signals — like passing tests or an agent's 'done' — for genuine verification of quality. The experience forms the basis of a new book the developer is writing on how to properly validate work produced by AI coding agents.

0
ProgrammingDEV Community ·

MgntUtils Stacktrace Filtering Cuts AI Token Costs in Live Java Production

A developer and author of the open-source Java library MgntUtils has published a production case study showing measurable cost and efficiency gains from its stacktrace-filtering feature. The tool strips out framework and infrastructure noise from Java server-side stacktraces, retaining only application-relevant frames and exception chains. Integrated into a high-traffic Spring Boot service processing over 70,000 stacktrace-bearing log events per day, the feature was monitored for roughly one month, including a controlled period where filtering was disabled for comparison. Results indicated significant AI token savings when stacktraces were fed to large language models for root-cause analysis, along with improved accuracy and reduced noise for human engineers. The unnamed commercial company uses structured JSON logging billed per event on a major observability platform, making stacktrace size reduction directly impactful on operational costs.

0
ProgrammingDEV Community ·

How Testing an AI Validation Gate Revealed Wider Failure Classes in LLM Pipelines

A developer building an AI-powered vendor suggestion tool discovered that a set of previously reliable prompts began returning placeholder outputs like 'Vendor A' and 'Vendor B' during staging. To address this, they constructed a validation layer where one model checks the output of another, designed to catch not just placeholder text but broader failure classes such as wrong-category vendors or defunct businesses. Because AI model failures cannot be reliably reproduced on demand, the developer used mock models in a TDD-style approach to simulate bad outputs and verify that the gate rejects them for the correct reasons. Real bad responses captured at runtime are also fed back as test cases, ensuring the test suite grows from actual system behavior rather than anticipated scenarios. The developer concludes that no automated gate can fully validate the truth of a model's guess, making human oversight, surfaced confidence scores, and user-driven regeneration essential safeguards at high-stakes decision points.

0
ProgrammingDEV Community ·

Developer Builds Full-Stack Real-Time Chess Platform Using MERN Stack and Socket.IO

A developer has created Chesso, a full-stack multiplayer chess platform designed to deliver low-latency, real-time online gameplay. The application is built on the MERN stack combined with Socket.IO for persistent WebSocket communication and Chess.js for move validation and game state management. Key features include a server-authoritative clock system to prevent client-side timer tampering, a matchmaking queue that pairs players and assigns piece colors, and a game recovery mechanism that restores match state from MongoDB using saved FEN strings after server restarts. Authentication is handled through Google OAuth 2.0, Passport.js, JWT tokens, and bcrypt password hashing to ensure session security. The developer chose Socket.IO over raw WebSockets for its built-in room abstraction, automatic reconnection fallback, and event-based broadcasting suited to turn-based real-time gameplay.