feat(detection): B3.2 false-positive reduction (fp 0.125 -> 0.0, recall held)#37
Merged
Merged
Conversation
…uire attack context
…duction (fp 0.125 -> 0.0)
github-actions
Bot
added
area: handlers
rennf93
added a commit
that referenced
this pull request
Jul 1, 2026
…eutral) (#36) * feat(detection): add detection_threat_score_threshold config field (default 1.0) * feat(detection): per-pattern weight map + resolver; attach weight to regex threats * feat(detection): additive anomaly scoring + threshold gate on is_threat * style(detection): consolidate anomaly-scoring test imports (ruff E402/I001/E501) * feat(detection): B3.2 false-positive reduction (fp 0.125 -> 0.0, recall held) (#37) * feat(detection): SELECT..FROM corroboration scoring (low weight + star/WHERE signals) * feat(detection): tighten ORDER BY / DDL / ERB / NoSQL patterns to require attack context * test(attack-sim): expand benign corpus + re-baseline after B3.2 FP reduction (fp 0.125 -> 0.0) --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com> * fix(tests): align comment-stripping tests to detect-not-reconstruct contract; harden SusPatternsManager singleton isolation in reset_state --------- Co-authored-by: Renn F <rennf93@users.noreply.github.com>
rennf93
added a commit
that referenced
this pull request
Jul 1, 2026
…-mirror repair (#38) Assembles the 3.3.0 release from the detection work merged since v3.2.0 (#33-#37) plus the ipinfo-None deprecation fix from the 3.2.1 line. - ipinfo_token/ipinfo_db_path DeprecationWarning no longer fires when the field is explicitly None (spurious warning for callers forwarding an optional setting). - Declare SusPatternsManager._threat_score_threshold and coerce _regex_anomaly to float, fixing the mypy attr-defined / no-any-return errors introduced by #36. - Exclude the async-only attack_simulation harness from unasync mirroring (its data corpus is not Python-transformable) and regenerate the previously-missing sync test mirrors; check-sync is green. - Bump version to 3.3.0 and add CHANGELOG / release-notes entries. Co-authored-by: Renn F <rennf93@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacks on #36 (B3.1). Closes out the B3 precision arc. Retarget to master once #36 merges.
Result (harness, expanded 56-sample benign corpus)
SELECT…FROM-in-prose (0.67) and the 4 FP vectors Phase B introduced.How
SELECT…FROMcorroboration scoring: its weight drops to 0.5 (via B3.1's override map); two new 0.5-weight signals (SELECT *, aWHERE <op>clause) push real SQLi back over the 1.0 threshold.SELECT * FROM usersand… WHERE id=1still flag; "select items from the catalog" no longer does.;separator; ERB requires dangerous content (not@user.name); NoSQL split into always-dangerous operators ($where/$regex/$type/$exists/…) vs comparison operators gated on injection-shaped values (""/null/{/[), so{"$gt": 5}is clean while{"$ne":null}/{"$where":…}still flag.Verification
358 tests pass (full detection + sync-mirror + attack-sim ratchet). 13 new FP-reduction unit tests pin each fix in both directions (attack flagged, benign near-miss clean). ruff/format/vulture clean; async/sync byte-identical.
Note
One over-reach caught mid-work by the ratchet: value-gating
$typedropped the{"$type":"string"}seed (recall 0.92->0.68); fixed by moving diagnostic operators to the always-dangerous group. Recall restored to 0.8568 exactly. No API/route changes.