Skip to main content

​
Confidence Levels

BTP assigns confidence levels to findings based on the detection method and validation process. These confidence levels help users understand the reliability of each finding. Confidence levels are shown the findings grids and in the details of each finding. They can also be found in the majority of the reporting and SBOM outputs.

​
Confidence Level Scale

ConfidenceLevelPercentileValueNumericalValueDescription
certain80% - 100%0.8 - 1.0Highest confidence, thoroughly validated findings
somewhat_certain60% - 80%0.6 - 0.8High confidence with minimal false positive potential
somewhat_uncertain40% - 60%0.4 - 0.6Moderate confidence, may require manual validation
uncertain20% - 40%0.2 - 0.4Lower confidence, higher false positive potential
very_uncertain1% - 20%0.01 - 0.2Lowest confidence, requires thorough manual verification

​
Calculation Methods

The confidence levels are determined through different methods depending on the type of detection:
  • Known Vulnerabilities: Tested on large datasets with verified results, typically achieving “certain” confidence levels
  • Secret Scanning: Uses regex-based rules, typically assigned “somewhat_uncertain” due to potential false positives
  • UEFI Unknown Detection: Validated through large-scale analysis of Dell firmware, achieving ~95% precision after manual analysis

​
JSON Example

{
  "component_id": "7e0a0a8e-2bd5-4400-97b6-de1125562f67",
  "name": "suspicious/posix/entrypoint",
  "confidence": 0.8,
  "kind": {
    "kind": "finding",
    "value": {
      "severity": "low",
      "identifiers": [],
      "classifications": [],
      "metrics": [],
      "predicates": [],
      "description": "The entry point of the ELF binary has been potentially modified",
      "evidence": []
    }
  }
}

​
Key Considerations

The confidence levels are assigned based on:
  • Detection method reliability
  • Historical accuracy of the detection mechanism
  • Potential for false positives
  • Need for manual validation
  • Complexity of the detection process
These confidence levels are continuously refined based on feedback and validation results to improve accuracy over time.