Skip to main content
Version: 1.5

Duplicates and copies of security issues

TRON.ASOC uses mechanisms to detect copies and deduplicate security issues. These mechanisms help find duplicate records and reduce redundant information in the results.

Difference between a copy and a duplicate​

A copy is a vulnerability that fully matches an existing vulnerability detected by the same scanning tool.

A duplicate is a similar vulnerability that may come from another tool or result from a code change. Duplicates aren't copies.

Detecting copies based on a hash​

The system uses a hash-based mechanism to detect vulnerability copies. The hash is generated from these vulnerability fields:

  • Tool_Type_name—scanning tool type;
  • CVE—CVE identifier;
  • CWE—CWE identifier;
  • Source_file—source file path;
  • Lib_name—library name;
  • Lib_version—library version;
  • Category—vulnerability category;
  • Source_object—source object;
  • Line—line number;
  • Matched_Code—matching code fragment.

The system detects copies as follows:

  1. When you start TRON.ASOC with hashing enabled, the system recalculates the hash for all existing vulnerabilities.
  2. The system detects and removes copies, keeping the earliest record from each set of copies.
  3. The system determines the remaining vulnerability's status based on this rule:
    • New—if at least one copy had an open status;
    • Fixed—if none of the copies had an open status.
warning

You can change hash parameters only through the configuration file. You can't manage them through the user interface.

note

The number of vulnerabilities in the scan results includes hashing.

Deduplicating issues​

Deduplication automatically finds and merges duplicate security issue records.

tip

For more information about configuring global deduplication rules, see Deduplication rules.

Finding duplicate security issues​

To view duplicate security issues, follow these steps:

  1. Go to Issues.
  2. Open the security issue that may have deduplication applied.
  3. Select Find and deduplicate similar issues from the Actions drop-down list.

Find and deduplicate

  1. In the window that opens on the right, set the required filters.

Filter issues

  1. Select Continue.

  2. Select the vulnerabilities from the list in the new window on the right.

  3. Select Mark as duplicate.

Mark duplicates

After you complete these steps, the system marks the issues as duplicates and links them to the new issue. The system interface also displays a notification.