Skip to main content
Version: 1.6

Configuring the AI False-Positive service

The AI False-Positive service (AI FP) uses AI to analyze TRON.ASOC scan results, identify false positives, and improve the accuracy of security checks.

You can install the service on the user's local infrastructure in one of two ways:

  • As part of TRON.ASOC: as an optional component that you can enable (recommended).
  • On separate infrastructure: as a standalone service connected to TRON.ASOC.

Service components​

Prepare the following components to install the AI FP service:

  1. vLLM server—a high-performance inference server for LLMs with an OpenAI-compatible API.
  2. copilot-fp-service—a REST API service that analyzes false positives. It receives analysis tasks from TRON.ASOC, sends them to the LLM, manages the queue, and returns results and recommendations.

You can deploy both components in one infrastructure environment using Docker Compose.

Technical requirements​

The requirements below apply to deployment with self-hosted vLLM. If you use an external LLM provider, the GPU and Hugging Face requirements don't apply.

Hardware​

The hardware must meet the following requirements:

  • An NVIDIA GPU server.
  • At least 16 GB of video memory (VRAM) for the default model (Qwen2.5-7B-Instruct).

Software​

The software must meet the following requirements:

  • Docker and Docker Compose installed.
  • Kubernetes installed (when you install the service as part of TRON.ASOC).
  • NVIDIA drivers (nvidia-driver) and NVIDIA Container Toolkit installed so Docker can use the GPU.
info

A separate database isn't required because the service stores tasks and results in memory.

Network requirements​

The network where you install the AI FP service must meet the following requirements:

  • Access to the Harbor container registry (harbor.tronsec.ru).
  • Access to the Hugging Face model repository to download the model when you use self-hosted vLLM.
info

The infrastructure where you install the AI FP service must be accessible from the network where TRON.ASOC runs.

When you use an external LLM provider instead of self-hosted vLLM, the GPU and Hugging Face access requirements don't apply.