Interpreting IFA results

IFA identifies the most actionable findings from an SAST security assessment.

IFA is based on statistical probability. Machine learning helps frame the probability of the security impact of a finding based on the training set currently in use. IFA represents probability of security impact in three ways, as follows:
  • the percent the finding is interesting
  • the percent the finding is a certain severity
  • the percent a finding is not interesting

Probabilities are between 0% and 100%. The closer to 100%, the more confident IFA is in the validity of the response.

Probability can be used as a guide during the manual review of IFA findings. The notes field of each finding has information on the probabilities that apply to the finding itself. View notes in the Finding View or the notes column in the various finding tables.

IFA runs in two phases, as follows:

  • Phase 1 uses pre-defined exclude filters to set findings as not interesting. This list of filters can be modified or augmented.

    Findings which are not interesting are set with the excluded flag and can be viewed in the Excluded Findings view in Source for Analysis.

  • Phase 2 uses supervised machine learning techniques on all remaining findings to determine if a finding is actionable.

    Findings which are interesting and/or actionable can be viewed in the Findings View in Source for Analysis.

In all cases, IFA adds a note describing why the finding was either included or excluded in the final IFA assessment. View notes in the Finding Detail View or the notes column in the finding tables present in other views.