Skip to main content
Version: 1.6

About the AI False-Positive (AI FP) Service

The AI False-Positive (AI FP) Service analyzes TRON.ASOC Scans with AI to identify false positives and improve the accuracy of security checks.

You can install the Service in the user's local infrastructure. It supports two installation methods:

  • as part of TRON.ASOC—as an optional component that you can enable (recommended);
  • in a separate infrastructure—as a standalone Service connected to TRON.ASOC.

Service components​

Prepare the following components to install the AI FP Service:

  1. vLLM server—a high-performance inference server for LLMs with an OpenAI-compatible API.
  2. copilot-fp-service—a REST API Service for false-positive analysis. It receives analysis tasks from TRON.ASOC, sends them to the LLM, manages the queue, and returns results and recommendations.

You can deploy both components in the same infrastructure using Docker Compose.

Technical Requirements​

The requirements below apply to deployment with self-hosted vLLM. If you use an external LLM provider, the GPU and Hugging Face requirements don't apply.

Hardware​

The hardware must meet the following requirements:

  • an NVIDIA GPU server;
  • at least 16 GB of video memory (VRAM) for the default model (Qwen2.5-7B-Instruct).

Software​

The software must meet the following requirements:

  • Docker and Docker Compose installed;
  • Kubernetes installed when you install the Service as part of TRON.ASOC;
  • NVIDIA drivers (nvidia-driver) and NVIDIA Container Toolkit installed to enable Docker to work with the GPU.
info

A separate Database isn't required because the Service stores tasks and results in memory.

Network requirements​

The network where you install the AI FP Service must meet the following requirements:

  • access to the Harbor container registry (harbor.tronsec.ru);
  • access to the Hugging Face model repository to download the model when you use self-hosted vLLM.
info

The infrastructure where you install the AI FP Service must be accessible from the network where TRON.ASOC runs.

When you use an external LLM provider instead of self-hosted vLLM, the GPU and Hugging Face access requirements don't apply.