Slashing SAST False Positives with CPG + LLM: An Open-Source Hybrid Vulnerability Validation Framework

SAST tools are essential in secure development, yet they generate overwhelming false positives that exhaust developer resources. This talk presents a fully open-source hybrid vulnerability validation framework using a three-stage pipeline: (1) integrating four SAST tools (cppcheck, flawfinder, RATS, CodeQL) with unified output normalization, (2) leveraging Joern to construct Code Property Graphs for extracting function context, dataflow paths, and caller/callee relationships, and (3) feeding CPG-enriched context to an LLM for systematic vulnerability path analysis. Evaluated on real-world projects like SQLite, the framework effectively filters false positives while maintaining high true vulnerability detection rates.