{"id":50988387,"url":"https://github.com/Akileshdash/rl-guided-static-analysis-rust","last_synced_at":"2026-07-07T22:00:31.850Z","repository":{"id":331260451,"uuid":"1125837263","full_name":"Akileshdash/rl-guided-static-analysis-rust","owner":"Akileshdash","description":"A reinforcement learning–guided framework for reducing false positives in static memory safety analysis of Rust programs.","archived":false,"fork":false,"pushed_at":"2025-12-31T17:48:16.000Z","size":2244,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-01-05T03:34:10.150Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Akileshdash.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-31T13:14:30.000Z","updated_at":"2025-12-31T17:48:19.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Akileshdash/rl-guided-static-analysis-rust","commit_stats":null,"previous_names":["akileshdash/rl-guided-static-analysis-rust"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/Akileshdash/rl-guided-static-analysis-rust","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Akileshdash%2Frl-guided-static-analysis-rust","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Akileshdash%2Frl-guided-static-analysis-rust/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Akileshdash%2Frl-guided-static-analysis-rust/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Akileshdash%2Frl-guided-static-analysis-rust/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Akileshdash","download_url":"https://codeload.github.com/Akileshdash/rl-guided-static-analysis-rust/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Akileshdash%2Frl-guided-static-analysis-rust/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35243953,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-07T02:00:07.222Z","response_time":90,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-06-19T23:00:38.172Z","updated_at":"2026-07-07T22:00:31.842Z","avatar_url":"https://github.com/Akileshdash.png","language":"Python","funding_links":[],"categories":["Dynamic Checkers"],"sub_categories":[],"readme":"# Mitigating False Positives in Rust Static Analysis via Reinforcement Learning\n\nThis repository contains the implementation of our research paper: **\"Mitigating False Positives in Static Memory Safety Analysis of Rust Programs via Reinforcement Learning\"**.\n\n## Overview\n\nStatic analysis tools like Rudra suffer from high false positive rates (50%+), which diminish developer trust and increase manual review effort. This project presents a novel reinforcement learning-based approach that:\n\n- **Reduces false positives** by more than doubling precision from 25.6% to 59.0%\n- **Maintains high recall** of 74.6%, identifying nearly three-quarters of true bugs\n- **Integrates selective fuzzing** to validate ambiguous warnings dynamically\n- **Outperforms LLM baselines** by 17.1 percentage points in F1 score\n- **Achieves 65.2% accuracy** with fuzzing vs. 54.5% without\n\n### Key Features\n\n- Proximal Policy Optimization (PPO) agent for warning classification\n- ~87 MIR-level semantic features extracted from Rust's Mid-level Intermediate Representation\n- Selective dynamic validation via cargo-fuzz integration\n- Three-action decision space: classify as true positive, false positive, or invoke fuzzing\n- Cost-aware reward function balancing accuracy and computational efficiency\n\n---\n\n## Repository Structure\n\n```\n.\n├── data/                          # Raw dataset\n├── RL_output/                     # Model predictions\n│   ├── rl.json                    # RL without fuzzing results\n│   └── rl_with_fuzzer.json        # RL with fuzzing results\n├── llm/                           # LLM baseline comparisons\n│   ├── jsons/                     # LLM prediction outputs\n│   │   ├── llm_results_claude_opus4_1.json\n│   │   ├── llm_results_codellama_34b.json\n│   │   ├── llm_results_gpt-4o-mini.json\n│   │   ├── llm_results_llama3_70b.json\n│   │   ├── llm_results_llama3_8b.json\n│   │   └── llm_results_mixtral.json\n│   └── scripts/                   # LLM evaluation scripts\n│       ├── claude_opus_llm_baseline.py\n│       ├── gpt-4o-mini_llm_baseline.py\n│       ├── run_codellama34b.py\n│       ├── run_llama3_70b.py\n│       ├── run_llama3_8b.py\n│       └── run_mixtral.py\n├── rl_without_fuzzing.py          # PPO agent WITHOUT fuzzing\n├── rl_with_fuzzing.py             # PPO agent WITH fuzzing integration\n├── ground_truth.json              # Manually labeled warnings dataset (1,247 labels)\n├── training_data.json             # Static analysis warnings with features (4,879 samples)\n├── result_table.py                # Generate comparison tables and metrics\n├── requirements.txt               # Python dependencies\n└── README.md                      # This file\n```\n\n---\n\n## Quick Start\n\n### Prerequisites\n\n- **Python**: 3.8 or higher\n- **Rust toolchain** (for actual fuzzing)\n- **cargo-fuzz** (for real fuzzing integration)\n\n### Installation\n\n1. **Clone the repository**\n```bash\ngit clone https://github.com/Akileshdash/rl-guided-static-analysis-rust.git\ncd rl-guided-static-analysis-rust\n```\n\n2. **Create a virtual environment (recommended)**\n```bash\npython -m venv venv\nsource venv/bin/activate  # On Windows: venv\\Scripts\\activate\n```\n\n3. **Install dependencies**\n```bash\npip install -r requirements.txt\n```\n\n---\n\n## Dataset\n\n### Dataset Construction\n\nOur dataset consists of:\n- **4,879 unique warnings** from Rudra's Unsafe Dataflow and Send/Sync Variance checkers\n- Collected from **~20,000 crates** from crates.io containing unsafe code\n- **1,247 true positives (25.6%)** and **3,632 false positives (74.4%)**\n- Manually labeled by domain experts with **82.7% inter-rater agreement** (Cohen's κ = 0.63)\n\n### Dataset Split\n- **Training set**: 70% (3,415 warnings)\n- **Validation set**: 15% (732 warnings)\n- **Test set**: 15% (732 warnings)\n\n### `ground_truth.json`\nContains manually labeled ground truth for each warning.\n\n```json\n[\n    {\n        \"file\": \"aarc-0.3.2_2.json\",\n        \"false_positive\": 0\n    }\n]\n```\n\n---\n\n## Running the Models\n\n### 1. PPO Agent (Without Fuzzing)\n\nTrains a reinforcement learning agent using only static features extracted from MIR.\n\n```bash\npython rl_without_fuzzing.py\n```\n\n**Expected Output:**\n```\n======================================================================\nPPO Agent for Rust Static Analysis False Positive Reduction\n======================================================================\n\nLoading data...\nLoaded 1247 ground truth labels\nLoaded 4879 training samples\n\nDataset split:\n  Training: 3415 samples (70%)\n  Validation: 732 samples (15%)\n  Test: 732 samples (15%)\n\nStarting training for 200 epochs...\nNetwork architecture: 87 -\u003e 256 -\u003e 128 -\u003e 2\n----------------------------------------------------------------------\nEpoch   1 | Acc: 52.34% | Loss:  12.3456 | Reward: -1234\nEpoch  10 | Acc: 54.12% | Loss:   8.7654 | Reward:   456\n...\nEpoch 200 | Acc: 54.52% | Loss:   2.1234 | Reward:  2345\n----------------------------------------------------------------------\nTraining complete!\n\nTest Set Results:\n  Accuracy:  54.5%\n  Precision: 49.6%\n  Recall:    67.9%\n  F1 Score:  57.3%\n  MCC:       0.117\n\nResults saved to RL_output/rl.json\n```\n\n**Output File:** `RL_output/rl.json`\n- Contains predictions for all test samples\n- Training history (accuracy, loss, reward per epoch)\n- Metadata with final metrics\n\n---\n\n### 2. PPO Agent with Fuzzing Integration\n\nTrains an agent that can selectively invoke cargo-fuzz for dynamic validation of ambiguous warnings.\n\n```bash\npython rl_with_fuzzing.py\n```\n\n**Expected Output:**\n```\n======================================================================\nPPO Agent with Fuzzing Integration\nRust Static Analysis False Positive Reduction\n======================================================================\n\nLoading data...\nLoaded 1247 ground truth labels\nLoaded 4879 training samples\n\nStarting training with fuzzing integration for 200 epochs...\nDataset size: 4879 samples\nAction space: 0=Classify_FP, 1=Classify_TP, 2=Invoke_Fuzzing\n----------------------------------------------------------------------\nEpoch   1 | Acc: 53.21% | Loss:  11.2345 | Reward: -1123 | Fuzz: 35.2%\nEpoch  10 | Acc: 58.45% | Loss:   7.6543 | Reward:   678 | Fuzz: 28.4%\n...\nEpoch 200 | Acc: 65.23% | Loss:   1.8765 | Reward:  3456 | Fuzz: 23.1%\n----------------------------------------------------------------------\nTraining complete!\n\nFuzzing Statistics:\n  Total invocations: ~23% of warnings\n  Successful bug findings: 342\n  Clean executions: 785\n  Fuzzing success rate: 30.3%\n\nTest Set Results:\n  Accuracy:  65.2%\n  Precision: 59.0%\n  Recall:    74.6%\n  F1 Score:  65.9%\n  MCC:       0.323\n  AUC-ROC:   0.661\n  AUC-PR:    0.554\n\nResults saved to RL_output/rl_with_fuzzer.json\n```\n\n**Output File:** `RL_output/rl_with_fuzzer.json`\n- Contains predictions with fuzzing metadata\n- Training history including fuzzing rates\n- Fuzzing statistics (invocations, success rate)\n- Confidence scores for each classification\n\n---\n\n### 3. Generate Results Table\n\nCompare all models (PPO, PPO+Fuzzing, LLM baselines) with standard metrics.\n\n```bash\npython result_table.py\n```\n\n**Expected Output:**\n```\n╔════════════════════════╦══════════╦═══════════╦════════╦═════════╦═══════╦═══════╦═══════╗\n║ Approach               ║ Accuracy ║ Precision ║ Recall ║ F1      ║ MCC   ║ ROC   ║ PR    ║\n╠════════════════════════╬══════════╬═══════════╬════════╬═════════╬═══════╬═══════╬═══════╣\n║ Raw Rudra Output       ║    —     ║ 0.256     ║ 1.000  ║ 0.407   ║   —   ║   —   ║   —   ║\n║ RL + Fuzzing           ║ 0.652    ║ 0.590     ║ 0.746  ║ 0.659   ║ 0.323 ║ 0.661 ║ 0.554 ║\n║ RL (No Fuzzing)        ║ 0.545    ║ 0.496     ║ 0.679  ║ 0.573   ║ 0.117 ║ 0.557 ║ 0.481 ║\n║ Claude Opus 4.1        ║ 0.533    ║ 0.486     ║ 0.669  ║ 0.563   ║ 0.094 ║ 0.546 ║ 0.474 ║\n║ ChatGPT-4o Mini        ║ 0.490    ║ 0.453     ║ 0.650  ║ 0.534   ║ 0.010 ║ 0.505 ║ 0.452 ║\n║ CodeLlama 34B          ║ 0.431    ║ 0.409     ║ 0.598  ║ 0.486   ║-0.112 ║ 0.446 ║ 0.425 ║\n║ Llama3 8B              ║ 0.487    ║ 0.437     ║ 0.487  ║ 0.460   ║-0.026 ║ 0.487 ║ 0.443 ║\n║ Mixtral 8x7B           ║ 0.326    ║ 0.328     ║ 0.476  ║ 0.388   ║-0.336 ║ 0.339 ║ 0.392 ║\n║ Llama3 70B             ║ 0.503    ║ 0.360     ║ 0.136  ║ 0.197   ║-0.082 ║ 0.469 ║ 0.437 ║\n╚════════════════════════╩══════════╩═══════════╩════════╩═════════╩═══════╩═══════╩═══════╝\n\nKey Findings:\n- RL+Fuzzing improves F1 by 17.1 percentage points over best LLM baseline\n- Precision more than doubles from 25.6% (raw Rudra) to 59.0%\n- Fuzzing provides 10.7 pp accuracy gain and 8.6 pp F1 gain over RL-only\n- Selective fuzzing invoked on ~23% of warnings for cost-aware validation\n```\n\n---\n\n## Requirements\n\n### Python Packages\n\n```txt\nnumpy\u003e=1.21.0\ntorch\u003e=1.9.0\nscikit-learn\u003e=0.24.0\n```\n\n### For Real Fuzzing\n\nFor actual cargo-fuzz integration:\n\n```bash\n# Install Rust toolchain\ncurl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh\n\n# Install cargo-fuzz\ncargo install cargo-fuzz\n\n# Install nightly Rust (required for fuzzing)\nrustup install nightly\nrustup default nightly\n```\n\n---\n\n## Configuration\n\n### Hyperparameters\n\nBoth `rl_without_fuzzing.py` and `rl_with_fuzzing.py` expose key hyperparameters that can be tuned:\n\n```python\n# Network architecture\nstate_size = 87           # MIR feature dimensions (~87 features)\nhidden1 = 256             # First hidden layer\nhidden2 = 128             # Second hidden layer\naction_size = 2           # Binary classification (3 for fuzzing variant)\n\n# Training parameters (PPO)\nepochs = 200              # Training epochs\nlearning_rate = 0.0003    # Learning rate for PPO\ngamma = 0.99              # Discount factor\nclip_epsilon = 0.2        # PPO clipping parameter\nvalue_coef = 0.5          # Value function coefficient\nentropy_coef = 0.01       # Entropy coefficient for exploration\n\n# Reward function\ncorrect_reward = 15       # Correct classification\nincorrect_penalty = -15   # Incorrect classification\nfuzzing_cost = -5         # Fuzzing invocation cost\nfuzzing_bonus_bug = 10    # Fuzzing found bug (confirms TP)\nfuzzing_bonus_clean = 8   # Fuzzing ran clean (suggests FP)\nfuzzing_bonus_helpful = 3 # Fuzzing helpful but not definitive\n```\n\n### Feature Extraction\n\nThe feature extraction pipeline processes MIR-level information organized into three categories:\n\n#### 1. MIR-Level Semantic Features (~50 features)\n- **Type system properties**: Generic parameters, trait bounds, generic nesting depth\n- **Ownership and borrowing**: Borrow ratios, nesting depth, smart pointer usage\n- **Control-flow**: Cyclomatic complexity, loop nesting, panic paths\n- **Unsafe operations**: Lifetime bypass category, distance to dangerous operations\n\n#### 2. Structural Code Features (~20 features)\n- **Package-level signals**: Download counts, unsafe code prevalence\n- **API surface**: Public vs. private API warnings\n- **Code metrics**: Lines of code, parameter counts, comment density\n\n#### 3. Analysis-Specific Features (~17 features)\n- **Rudra metadata**: Checker type, precision level\n- **Clustering**: Multiple warnings at nearby locations\n- **Pattern type**: Panic safety, higher-order invariants, Send/Sync variance\n\n**Total: ~87 normalized features** after correlation removal and domain filtering\n\n---\n\n## Methodology\n\n### Reinforcement Learning Formulation\n\nOur approach formulates false positive reduction as a Markov Decision Process (MDP):\n\n- **State Space**: 87-dimensional feature vectors extracted from MIR\n- **Action Space**: \n  - Action 0: Classify as False Positive\n  - Action 1: Classify as True Positive\n  - Action 2: Invoke Dynamic Fuzzing (fuzzing variant only)\n- **Reward Function**: Balances classification accuracy against computational cost\n- **Policy Network**: Two hidden layers (256 → 128 units) with ReLU activations and dropout\n- **Algorithm**: Proximal Policy Optimization (PPO)\n\n### Selective Fuzzing Strategy\n\nThe agent learns to invoke fuzzing based on confidence estimates:\n1. **Q-value gap**: Smaller gaps indicate uncertainty\n2. **Policy entropy**: Higher entropy reflects lower confidence\n3. **Cost-aware decision**: Balances fuzzing cost (-5) against expected information gain\n\nFuzzing outcomes are encoded into state representation:\n- **Crash/sanitizer violation** → Strong TP evidence (+10 bonus)\n- **Clean execution** → Moderate FP evidence (+8 bonus)\n- **Timeout/inconclusive** → Weak signal (+3 bonus)\n\n---\n\n## Bug Pattern Coverage\n\nRudra targets three critical classes of memory safety bugs in unsafe Rust:\n\n1. **Panic Safety**: Stack unwinding during panics can violate invariants\n   - Example: CVE-2020-36317 in `String::retain()`\n\n2. **Higher-Order Invariants**: Semantic assumptions about generic functions\n   - Example: CVE-2020-36323 in `join()` (impure `Borrow` implementations)\n\n3. **Send/Sync Variance**: Missing or incorrect thread-safety bounds\n   - Example: CVE-2020-35905 in futures-rs `MappedMutexGuard`\n\n---\n\n## Performance Comparison\n\n### Key Improvements Over Baselines\n\n| Metric | Raw Rudra | RL Only | RL+Fuzzing | Improvement |\n|--------|-----------|---------|------------|-------------|\n| Precision | 25.6% | 49.6% | **59.0%** | +130% |\n| Recall | 100% | 67.9% | **74.6%** | -25.4% (acceptable) |\n| F1 Score | 40.7% | 57.3% | **65.9%** | +61.9% |\n| Accuracy | — | 54.5% | **65.2%** | +19.6% |\n\n### Fuzzing Impact\n\n- **10.7 percentage points** accuracy gain over RL-only\n- **8.6 percentage points** F1 score improvement\n- **Invoked on ~23%** of warnings (cost-effective)\n- **30.3% success rate** in finding bugs when invoked\n\n---\n\n## Acknowledgments\n\n- Original Rudra implementation by Yechan Bae et al.\n- Rust compiler team for MIR infrastructure\n- cargo-fuzz developers for fuzzing integration\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAkileshdash%2Frl-guided-static-analysis-rust","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FAkileshdash%2Frl-guided-static-analysis-rust","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FAkileshdash%2Frl-guided-static-analysis-rust/lists"}