Software Security Finding De-duplication via Normalization and Fingerprinting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security analysis tools struggle to effectively de-duplicate findings from multiple static application security testing (SAST) tools, leading to incorrect or incomplete combinations due to intolerance of small changes and differences in formats, making it difficult for developers and security personnel to focus on individual software security issues.
Innovation Solution
A system that normalizes findings from various software security analysis tools to a standardized taxonomy, determines fingerprints for each finding, and compares these to identify partial or full matches, allowing for the storage of updates and historical developments, thereby providing a unified, simplified view of software security issues through a graphical user interface.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing tools simply aggregate data without de-duplication, then the combination process is simple, but the results contain incorrect or incomplete combinations due to partial matches among findings
Solution Approach 1:
The patent introduces a de-duplication system as an intermediary layer between multiple SAST tools and the final findings aggregation. This system receives findings from different tools, normalizes them to a common format, compares them using fingerprinting algorithms, and produces a de-duplicated result set. The intermediary handles the complexity of format differences and partial matches, allowing reliable combination without requiring the aggregation layer to understand tool-specific formats.
Solution Approach 2:
The patent segments the finding combination process into distinct stages: (1) data collection from multiple SAST tools, (2) normalization to standardized format, (3) fingerprinting and comparison for de-duplication, (4) aggregation of de-duplicated findings. This segmentation allows each stage to be optimized independently, improving reliability without overwhelming complexity in any single component.
2Reliability
If existing tools attempt to de-duplicate findings, then duplicate findings are reduced, but small changes or differences in formats cause ineffectual de-duplication
Solution Approach 1:
The patent transforms findings from various SAST tools by changing their format parameters to a standardized normalization format. This parameter transformation includes converting vendor-specific field names, data structures, and representations into a common schema. By standardizing parameters before comparison, the system achieves both effective de-duplication and tolerance to format differences.
Solution Approach 2:
The normalization layer acts as an intermediary that mediates between diverse input formats and the de-duplication logic. It translates various vendor formats into a universal intermediate representation, allowing the fingerprinting algorithm to compare findings based on their semantic content rather than format-specific syntax, thus achieving both reliability and adaptability.
3Adaptability or versatility
If multiple SAST tools from different vendors are used, then more comprehensive security analysis is achieved, but the variety of vendor-specific formats increases the difficulty of de-duplication
Solution Approach 1:
The patent implements a universal normalization layer that can handle findings from multiple SAST tool vendors through a single interface. This multi-functional component accepts various vendor-specific formats (Fortify, Checkmarx, etc.) and converts them all to a common standardized format, eliminating the need for separate handling logic for each vendor and reducing overall system complexity.
Solution Approach 2:
The normalization intermediary shields the de-duplication logic from the complexity of vendor-specific formats. By introducing this mediating layer, the system can comprehensively analyze security issues from multiple tools while the intermediary handles all format conversion complexity, allowing versatile coverage without proportional increase in complexity.
Data Source
AI summary
A system for performing de-duplication of findings includes a non-transitory computer readable medium and a processor. The non-transitory computer readable medium stores normalized findings of application code performed by at least one software security analysis tool. Each normalized finding is identifiable by a fingerprint. The processor receives a first finding in a first vendor-provided format from a first software security analysis tool that performs a scan of application code. The processor receives a second finding in a second vendor-provided format from a second software security analysis tool. The processor normalizes the findings to a standardized taxonomy. The processor determines a first fingerprint and a second fingerprint that respectively identify the normalized first and second findings. The processor determines any need to update the normalized first finding by comparing the normalized second finding with the normalized first finding after determining that the second fingerprint at least partially matches the first fingerprint.