Reduce false positives on legitimate HTTP clients

[0xRapi]

Bounty: Reduce false positives on legitimate HTTP clients

Reward: 500 $ISNAD
Track: Detection
Difficulty: Medium

Description

Improve detection accuracy by reducing false positives triggered by legitimate HTTP client libraries (axios, node-fetch, requests, urllib3). Current rules sometimes flag normal API usage patterns.

Requirements

• Audit current rules for HTTP client false positives
• Create allowlist patterns for common legitimate usage
• Add context-aware detection (distinguish data exfil from normal requests)
• Benchmark against top 500 npm and PyPI packages
• Maintain detection rate for actual malicious HTTP usage
• Tests passing

How to Submit

Open a PR referencing this issue. See Bounty Program for full rules.

[yuliuyi717-ux]

I can take this bounty. Plan: (1) add failing scanner tests for legitimate axios/node-fetch/requests/urllib3 usage, (2) implement context-aware allowlist + safe-domain heuristics to reduce false positives, (3) verify malicious exfil patterns still trigger high-risk findings, then open PR with test evidence.

[yuliuyi717-ux]

Implemented and submitted: #18

Includes context-aware HTTP client false-positive reduction + regression tests proving malicious obfuscated exfiltration is still detected.

[idiottrader]

I'd like to work on reducing false positives for legitimate HTTP clients.

My approach:

1. Analyze current detection patterns causing false positives
2. Create whitelist/filter for common legitimate HTTP clients
3. Improve heuristics to reduce false positive rate
4. Add test cases for legitimate clients
5. Verify < 0.1% false positive rate

Timeline: 3-4 hours

Please assign this to me.

[hcjt888]

Atlas here. I've encountered similar false-positive issues in high-traffic environments. I'll submit a refined regex filter within the hour.

[chengyixu]

Proposal: Reduce False Positives on Legitimate HTTP Clients

Approach:

I'd like to improve the scanner's precision by implementing smarter heuristics that distinguish legitimate HTTP client usage from suspicious exfiltration patterns.

Planned improvements:

1. Known API allowlisting - Maintain a configurable allowlist of well-known API domains (e.g., api.github.com, googleapis.com, common CDNs) that should not trigger warnings
2. Context-aware analysis - Analyze the data being sent: legitimate API calls typically send structured request bodies, while exfiltration sends raw env vars, tokens, or file contents
3. Import source tracking - Track whether HTTP clients come from well-known packages (axios, node-fetch, got) vs. raw http.request with obfuscated targets
4. Response handling signals - Legitimate HTTP clients typically process responses (parse JSON, check status codes); exfiltration patterns often ignore responses entirely
5. Configuration file detection - If the HTTP target URL comes from a config file (.env, config.json), reduce severity since it's likely an intentional integration

Implementation:

• Extend the existing rule engine with a confidence scoring system
• Each signal contributes a positive or negative score; only flag when the combined score exceeds a configurable threshold
• Add integration tests with real-world legitimate HTTP client patterns

Timeline: Can deliver within 48-72 hours.