# US 11,113,406 B2 · Methods and systems for de-duplication of findings > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,113,406 B2 - Document ID: US11113406B2 - Status: Granted - Kind: B2 - Application number: 16/504,367 - Filed: 2019-07-08 - Published: 2020-04-30 - Granted: 2021-09-07 - Earliest claimed: 2018-10-31 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Adam Youngberg; Stephen Kent - Web page: https://patentgrep.com/patent/US11113406B2 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 16/1748: {De-duplication implemented within the file system, e.g. based on file segments (de-duplication techniques in storage systems for the management of data blocks G06F3/0641)} - G06F 21/552: {involving long-term monitoring or reporting} - G06F 21/562: {Static detection} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A system for performing de-duplication of findings includes a non-transitory computer readable medium and a processor. The non-transitory computer readable medium stores normalized findings of application code performed by at least one software security analysis tool. Each normalized finding is identifiable by a fingerprint. The processor receives a first finding in a first vendor-provided format from a first software security analysis tool that performs a scan of application code. The processor receives a second finding in a second vendor-provided format from a second software security analysis tool. The processor normalizes the findings to a standardized taxonomy. The processor determines a first fingerprint and a second fingerprint that respectively identify the normalized first and second findings. The processor determines any need to update the normalized first finding by comparing the normalized second finding with the normalized first finding after determining that the second fingerprint at least partially matches the first fingerprint. ## Claims ### Claim 1 A system for performing de-duplication of findings, comprising: one or more processors; a graphical user interface configured for display and operably connected to the one or more processors; and a memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, are configured to: receive, from a first software security analysis tool, a first finding comprising one or more software issues, the first software security analysis tool being a Static Application Security Testing (SAST) tool or a Dynamic Application Security Testing (DAST) tool; determine a first identifier that identifies the first finding; store the first finding and the first identifier; receive, from a second software security analysis tool, a second finding comprising one or more software issues, the second software security analysis tool being a Static Application Security Testing (SAST) tool or a Dynamic Application Security Testing (DAST) tool; determine a second identifier that identifies the second finding; determine that the second identifier at least partially matches the first identifier; appending the first finding to the second finding; comparing the one or more software issues of the first finding to the one or more software issues of the second finding to determine at least a partial match; and removing the at least partial match from the first finding. ### Claim 2 (depends on 1) The system of claim 1, wherein the one or more processors are further configured to normalize the first finding and the second finding to a standardized taxonomy. ### Claim 3 (depends on 2) The system of claim 2, wherein the normalized first finding is associated with a first timestamp, and the normalized second finding is associated with a second timestamp. ### Claim 4 (depends on 3) The system of claim 3, wherein the one or more processors are further configured to: store an update to the normalized first finding after determining that the normalized second finding differs from the normalized first finding, the update to the normalized first finding being associated with the second timestamp; cause the graphical user interface to display the normalized first finding and the first timestamp; and cause the graphical user interface to display the update to the normalized first finding and the second timestamp. ### Claim 5 (depends on 3) The system of claim 3, wherein the one or more processors are further configured to: store the normalized first finding and the normalized second finding as historical updates; and cause the graphical user interface to display the historical updates upon request. ### Claim 6 (depends on 1) The system of claim 1, wherein each of the first and second identifier includes at least one of: name, category, or a severity of a finding. ### Claim 7 (depends on 1) The system of claim 1, wherein the first finding and the second finding are in a vendor-provided format. ### Claim 8 A system for performing de-duplication of findings, comprising: one or more processors; a graphical user interface configured for display and operably connected to the one or more processors; and a memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, are configured to: receive, from a first software security analysis tool, a first finding comprising one or more software issues, the first software security analysis tool comprising a Static Application Security Testing (SAST) tool or a Dynamic Application Security Testing (DAST) tool; determine a first identifier that identifies the first finding; store the first finding and the first identifier; receive, from a second software security analysis tool, a second finding comprising one or more software issues, the second software security analysis tool comprising a Static Application Security Testing (SAST) tool or a Dynamic Application Security Testing (DAST) tool; determine a second identifier that identifies the second finding; determine that the second identifier at least partially matches the first identifier; append the first finding to the second finding; compare the one or more software issues of the first finding to the one or more software issues of the second finding to determine at least a partial match; and remove the at least partial match from the first finding to create an update first finding; store the updated first finding; cause the graphical user interface to display the updated first finding; and cause the graphical user interface to display the first finding prior to the update. ### Claim 9 (depends on 8) The system of claim 8, wherein the one or more processors are further configured to normalize the first finding and the second finding to a standardized taxonomy, and wherein the normalized first finding is associated with a first timestamp, and the normalized second finding is associated with a second timestamp. ### Claim 10 (depends on 9) The system of claim 9, wherein the one or more processors are further configured to: store the normalized first finding and the normalized second finding as historical updates; and cause the graphical user interface to display the historical updates upon request. ### Claim 11 (depends on 8) The system of claim 8, wherein the first software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution, and the second software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution. ### Claim 12 (depends on 8) The system of claim 8, wherein each of the first and second identifier includes at least one of: name, category, or a severity of a finding. ### Claim 13 A system for performing de-duplication of findings, comprising: one or more processors; a graphical user interface configured for display and operably connected to the one or more processors; and a memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, are configured to: receive, from a first software security analysis tool comprising a Static Application Security Testing (SAST) tool or a Dynamic Application Security Testing (DAST) tool, a first finding, wherein the first finding includes one or more respective software issues and a first identifier; store the first finding and the first identifier; receive, from a second software security analysis tool comprising a Static Application Security Testing (SAST) tool or a Dynamic Application Security Testing (DAST) tool, a second finding, wherein the second finding includes one or more respective software issues and a second identifier; determine that the second identifier at least partially matches the first identifier; generate a third finding by combining the first finding with the second finding; compare the one or more software issues of the first finding to the one or more software issues of the second finding to determine at least a partial match; remove the at least partial match from the third finding; store the third finding; cause the graphical user interface to display the third finding; and cause the graphical user interface to display the first finding. ### Claim 14 (depends on 13) The system of claim 13, wherein the one or more processors is further configured to normalize the first finding and the second finding to a standardized taxonomy, and wherein the normalized first finding is associated with a first timestamp, and the normalized second finding is associated with a second timestamp. ### Claim 15 (depends on 14) The system of claim 14, wherein the one or more processors are further configured to: store the normalized first finding and the normalized second finding as historical updates; and cause the graphical user interface to display the historical updates upon request. ### Claim 16 (depends on 13) The system of claim 13, wherein the first software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution, and the second software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution. ### Claim 17 (depends on 13) The system of claim 13, wherein each of the first and second identifier includes at least one of: name, category, or a severity of a finding. ### Claim 18 (depends on 13) The system of claim 13, wherein the first software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution, and the second software security analysis tool is a standalone solution, a network-based client-server solution, a web-based solution, or a cloud-based solution.