chore: change rules for fake email analyzer to reduce FPs (#1146)

Added in further heuristics in combination with the fake email analyzer to reduce FPs.

Signed-off-by: Carl Flottmann <[email protected]>

Author: art1f1c3R

src/macaron/slsa_analyzer/checks/detect_malicious_metadata_check.py

@@ -433,22 +433,29 @@ def run_check(self, ctx: AnalyzeContext) -> CheckResultData:
         failed({Heuristics.ONE_RELEASE.value}),
         failed({Heuristics.ANOMALOUS_VERSION.value}).
 
-    % Package released recently with the a maintainer email address that is not valid.
+    % Package has no links, one release or multiple quick releases, and a suspicious maintainer who recently
+    % joined, has a fake email address, and other similarly-structured projects.
     {Confidence.MEDIUM.value}::trigger(malware_medium_confidence_3) :-
         quickUndetailed,
-        failed({Heuristics.FAKE_EMAIL.value}),
-        failed({Heuristics.SIMILAR_PROJECTS.value}).
-
+        failed({Heuristics.SIMILAR_PROJECTS.value}),
+        failed({Heuristics.ONE_RELEASE.value}),
+        failed({Heuristics.FAKE_EMAIL.value}).
+    {Confidence.MEDIUM.value}::trigger(malware_medium_confidence_4) :-
+        quickUndetailed,
+        failed({Heuristics.SIMILAR_PROJECTS.value}),
+        failed({Heuristics.HIGH_RELEASE_FREQUENCY.value}),
+        failed({Heuristics.FAKE_EMAIL.value}).
     % ----- Evaluation -----
 
     % Aggregate result
     {problog_result_access} :- trigger(malware_high_confidence_1).
     {problog_result_access} :- trigger(malware_high_confidence_2).
     {problog_result_access} :- trigger(malware_high_confidence_3).
     {problog_result_access} :- trigger(malware_high_confidence_4).
-    {problog_result_access} :- trigger(malware_medium_confidence_3).
-    {problog_result_access} :- trigger(malware_medium_confidence_2).
     {problog_result_access} :- trigger(malware_medium_confidence_1).
+    {problog_result_access} :- trigger(malware_medium_confidence_2).
+    {problog_result_access} :- trigger(malware_medium_confidence_3).
+    {problog_result_access} :- trigger(malware_medium_confidence_4).
     query({problog_result_access}).
 
     % Explainability