一句话：本文实证研究用机器学习对程序分析工具输出的 Node.js 漏洞报告进行优先级分诊，显著减少人工审查。
程序分析工具会产生大量候选漏洞报告，人工审查成本高昂，需要判断哪些报告最可能是真实漏洞。本文针对 Node.js 包，构建含 1,883 个包、每包含一个 ACE 或 ACI 漏洞的基准，基于 NodeMedic-FINE 输出训练并比较经典模型、图神经网络（GNN）、大语言模型（LLM）及 GNN-LLM 混合模型。最佳 LLM 达到 F1=0.915，最佳基于溯源图的方法达到 F1=0.904。在上游工具标记但无法自动确认的报告上，若目标为召回 90% 可利用报告，领先模型可减少 75% 良性报告的人工审查；按精确率 0.8 调优时，可报告 99.2% 可利用污点流，仅漏报 0.8%。结果表明机器学习用于真实漏洞分诊具有很强潜力。
Program analysis tools often produce large volumes of candidate vulnerability reports that require costly manual review, creating a practical challenge: how can security analysts prioritize the reports most likely to be true vulnerabilities? This paper investigates whether machine learning can be applied to prioritizing vulnerabilities reported by program analysis tools. We focus on Node.js packages and collect a benchmark of 1,883 Node.js packages, each containing one reported ACE or ACI vulnerability. We evaluate a variety of machine learning approaches, including classical models, graph neural networks (GNNs), large language models (LLMs), and hybrid models that combine GNNs and LLMs, trained on data derived from program analysis tool outputs (NodeMedic-FINE in our case study). The top LLM achieves F1=0.915, while the best provenance-graph-based method achieves F1=0.904. On the reports that the upstream tool flags but cannot automatically confirm, at a target of recovering 90% of the exploitable reports, the leading model eliminates 75% of the benign reports from manual review. If the best model is tuned to operate at a precision level of 0.8 (i.e., allowing 20% false positives among all warnings), our approach can report 99.2% of exploitable taint flows while missing only 0.8%, demonstrating strong potential for real-world vulnerability triage.
@inproceedings{paperbot12572,
title = {Learning to Triage Vulnerability Reports from Program Analysis: An Empirical Study in Node.js},
author = {Ronghao Ni and Aidan Z.H. Yang and Min-Chien Hsu and Nuno Sabino and Limin Jia and Ruben Martins and Darion Cassel and Kevin Cheang},
booktitle = {ASE},
year = {2026},
doi = {10.1145/3832783.3837503}
}