Skip to main content
Version: 1.7

AI False-Positive service configuration

The AI False-Positive (AI FP) Service uses AI to analyze the results of TRON.ASOC Scans, identify false positives, and improve the accuracy of security checks.

You can install the Service on the user's local infrastructure. It supports two installation methods:

  • as an optional component of TRON.ASOC (recommended);
  • on separate infrastructure as a standalone service connected to TRON.ASOC.

Service components​

Prepare the following components to install the AI FP Service:

  1. vLLM server—a high-performance inference server for LLMs with an OpenAI-compatible API.
  2. copilot-fp-service—a REST API service for false-positive analysis. It receives analysis tasks from TRON.ASOC, sends them to the LLM, manages the queue, and returns results and recommendations.

You can deploy both components in the same infrastructure with Docker Compose.

Technical requirements​

The requirements below apply to the self-hosted vLLM deployment method. If you use an external LLM provider, the GPU and Hugging Face requirements don't apply.

Hardware​

The hardware must meet the following requirements:

  • a server with an NVIDIA GPU;
  • at least 16 GB of video memory (VRAM) for the default model (Qwen2.5-7B-Instruct).

Software​

The software must meet the following requirements:

  • Docker and Docker Compose installed;
  • Kubernetes installed (when you install the Service as part of TRON.ASOC);
  • NVIDIA drivers (nvidia-driver) and NVIDIA Container Toolkit installed so Docker can work with the GPU.
info

A separate Database isn't required because the Service stores tasks and results in memory.

Network requirements​

The network where you install the AI FP Service must meet the following requirements:

  • access to the Harbor container registry (harbor.tronsec.ru);
  • access to the Hugging Face model repository to download the model when you use self-hosted vLLM.
info

The infrastructure where you install the AI FP Service must be accessible from the network where TRON.ASOC runs.

When you use an external LLM provider instead of self-hosted vLLM, the GPU and Hugging Face access requirements don't apply.