Skip to main content
Version: 1.6.1

About the AI False-Positive (AI FP) Service

The AI False-Positive (AI FP) Service uses AI to analyze TRON.ASOC scan results, identify false positives, and improve the accuracy of security checks.

You can install the Service on the user's local infrastructure. You can install it in one of two ways:

  • as part of TRON.ASOC, as an optionally enabled component (recommended);
  • on separate infrastructure, as a standalone Service connected to TRON.ASOC.

Service components​

Prepare the following components to install the AI FP Service:

  1. vLLM server—a high-performance inference server for LLMs with an OpenAI-compatible API.
  2. copilot-fp-service—a REST API Service for false-positive analysis. It receives analysis tasks from TRON.ASOC, sends them to the LLM, manages the queue, and returns results and recommendations.

You can deploy both components on the same infrastructure by using Docker Compose.

Technical Requirements​

The Requirements below apply to deployment with self-hosted vLLM. If you use an external LLM provider, the GPU and Hugging Face Requirements don't apply.

Hardware​

The hardware must meet the following Requirements:

  • an NVIDIA GPU server;
  • at least 16 GB of video memory (VRAM) for the default model (Qwen2.5-7B-Instruct).

Software​

The software must meet the following Requirements:

  • Docker and Docker Compose installed;
  • Kubernetes installed when you install the Service as part of TRON.ASOC;
  • NVIDIA drivers (nvidia-driver) and the NVIDIA Container Toolkit installed so Docker can use the GPU.
info

A separate Database isn't required because the Service stores tasks and results in memory.

Network Requirements​

The network where you install the AI FP Service must meet the following Requirements:

  • access to the Harbor container registry (harbor.tronsec.ru);
  • access to the Hugging Face model repository to download the model when you use self-hosted vLLM.
info

The infrastructure where you install the AI FP Service must be accessible from the network where TRON.ASOC runs.

When you use an external LLM provider instead of self-hosted vLLM, the GPU and Hugging Face access Requirements don't apply.