Patent ID: 11888885
Assignee: WELLS FARGO BANK, N.A.
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 17:
18. A method for identifying security vulnerabilities in a third party software component, the method comprising:
generating a test application for the third party software component;
identifying each method and function used in the third party software component;
using the test application to implement a method call or a function call for each identified method and function, respectively, in the third party software component;
analyzing the test application and the third party software component in a static application security testing (SAST) code analyzer, the analyzing of the test application and the software library in the SAST code analyzer comprising identifying a plurality of software entry points in the third party software component;
obtaining one or more test results from the SAST code analyzer, wherein the one or more test results include manual test results in which one or more individuals have identified false positives;
using the manual test results to identify security vulnerabilities in the third party software component; and
using the manual test results to generate custom rules used when testing new applications that use the third party software component, wherein the custom rules are automatically generated by a custom rules generator, and wherein the custom rules model a behavior of a third party component and include passing tainted data from the test application to the software library.