US 12,032,703 B2
Automatically rating the product's security during software development
Ronald Del Rosario, Mountain House, CA (US)
Assigned to SAP SE, Walldorf (DE)
Filed by SAP SE, Walldorf (DE)
Filed on Jul. 6, 2021, as Appl. No. 17/368,082.
Prior Publication US 2023/0012722 A1, Jan. 19, 2023
Int. Cl. G06F 21/57 (2013.01); G06N 3/02 (2006.01); G06N 20/00 (2019.01)
CPC G06F 21/577 (2013.01) [G06N 3/02 (2013.01); G06N 20/00 (2019.01); G06F 2221/033 (2013.01)] 16 Claims
OG exemplary drawing
 
1. A system, comprising:
at least one data processor; and
at least one memory storing instructions which, when executed by the at least one data processor, result in operations comprising:
receiving a first report from at least a first vulnerability evaluation tool, the first report including text indicating at least one vulnerability of an application being evaluated;
pre-processing the first report by at least tokenizing the first report and generating a first vector for a first text portion of the first report;
providing, to a machine learning model, the first vector as an input;
classifying, by the machine learning model, the first vector based on a plurality of vulnerability vectors generated from a database of vulnerability policies required for an evaluation of the application;
outputting, by the machine learning model, a first indication of a first match between the first vector and a first vulnerability vector of the plurality of vulnerability vectors, the first indication representing a presence in the application of a first vulnerability mapped to the first vulnerability vector of the plurality of vulnerability vectors generated from the database of vulnerability policies; and
generating, for the application, a vulnerability score based on a quantity of indications classified by the machine learning model, wherein the vulnerability score is determined by reducing a pre-determined score by the quantity of the indications including the first indication and one or more other indications.