3 ms·
Exactly. There is typically no algorithm to correctly decide yes/no on a vulnerability for any input program. But there are algorithms that can correctly repor
by cvoss 4y ago
Exactly.
There is typically no algorithm to correctly decide yes/no on a vulnerability for any input program. But there are algorithms that can correctly report maybe/no. The trivial example: the algorithm that always reports "maybe".
The field of static analysis is about improving on the precision of this trivial algorithm so that it reports "no" whenever it can, within resource constraints.
- wslh 4y agoThere are no general algorithms that can report a "no" to general source code. The maybe is obviously not considered in the context of this discussion thread about ML. It is obvious that ML. A simple search on Internet could give you resources like this: https://arxiv.org/abs/2110.09610 https://arxiv.org/abs/2110.09610
- cvoss 4y ago> The maybe is obviously not considered in the context of this discussion thread about ML. What do you mean by that statement? The only thing ML can do with a decision question is report "maybe" with some confidence. For example, "I am 98.3% sure this image has a cat in it, with respect to the data sets I was trained on" or "I am 77% confident this source code misuses a web request API, given the examples and non-examples of misuse that you have shown me."