Patent ID: 11928221
Assignee: BANK OF AMERICA CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 7:
8. A method comprising:
generating a plurality of source code fingerprints, each source code fingerprint of the plurality of source code fingerprints corresponding to a source code segment of a plurality of source code segments, wherein generating the source code fingerprint comprises:
generating, from the corresponding source code segment, an abstract syntax tree;
performing a data flow analysis on the corresponding source code segment, to generate information identifying flows of data through the corresponding source code segment;
augmenting the abstract syntax tree associated with the source code segment with the information identifying the flows of data through the source code segment; and
flattening the augmented abstract syntax tree associated with the source code segment;

determining that the source code fingerprint corresponding to a first source code segment matches the source code fingerprint corresponding to a second source code segment, wherein:
the first source code segment is associated with a first plurality of vulnerability findings generated through static application security testing (SAST) of the first source code segment, the first plurality of vulnerability findings comprising:
a first vulnerability finding that has been classified as a real vulnerability by an external review; and
a second vulnerability finding that has been classified as a false positive by the external review; and

the second source code segment is associated with a second plurality of vulnerability findings generate through SAST of the second source code segment; and

in response to determining that the source code fingerprint corresponding to the first source code segment matches the source code fingerprint corresponding to the second source code segment:
automatically classifying a first vulnerability finding of the second plurality of vulnerability findings as the verified vulnerability finding, in response to determining that the first vulnerability finding of the second plurality of vulnerability findings matches the first vulnerability finding of the first plurality of vulnerability findings; and
automatically classifying a second vulnerability finding of the second plurality of vulnerability findings as the false positive, in response to determining that the second vulnerability finding of the second plurality of vulnerability findings matches the second vulnerability finding of the first plurality of vulnerability findings.