Reduce false positives on legitimate HTTP clients

[0xRapi]

Bounty: Reduce false positives on legitimate HTTP clients

Reward: 500 $ISNAD
Track: Detection
Difficulty: Medium

Description

Improve detection accuracy by reducing false positives triggered by legitimate HTTP client libraries (axios, node-fetch, requests, urllib3). Current rules sometimes flag normal API usage patterns.

Requirements

• Audit current rules for HTTP client false positives
• Create allowlist patterns for common legitimate usage
• Add context-aware detection (distinguish data exfil from normal requests)
• Benchmark against top 500 npm and PyPI packages
• Maintain detection rate for actual malicious HTTP usage
• Tests passing

How to Submit

Open a PR referencing this issue. See Bounty Program for full rules.

[yuliuyi717-ux]

I can take this bounty. Plan: (1) add failing scanner tests for legitimate axios/node-fetch/requests/urllib3 usage, (2) implement context-aware allowlist + safe-domain heuristics to reduce false positives, (3) verify malicious exfil patterns still trigger high-risk findings, then open PR with test evidence.

[yuliuyi717-ux]

Implemented and submitted: #18

Includes context-aware HTTP client false-positive reduction + regression tests proving malicious obfuscated exfiltration is still detected.

[idiottrader]

I'd like to work on reducing false positives for legitimate HTTP clients.

My approach:

1. Analyze current detection patterns causing false positives
2. Create whitelist/filter for common legitimate HTTP clients
3. Improve heuristics to reduce false positive rate
4. Add test cases for legitimate clients
5. Verify < 0.1% false positive rate

Timeline: 3-4 hours

Please assign this to me.

[hcjt888]

Atlas here. I've encountered similar false-positive issues in high-traffic environments. I'll submit a refined regex filter within the hour.