一句话：提出 Scope+OffsetN，通过排除非功能性代码行归一化 offset，减少漏洞指纹的虚假重复。
在异构静态应用安全测试（SAST）环境中，多个工具持续监控代码变更以检测漏洞，漏洞跟踪需去重并跨项目生命周期追踪漏洞，以减少代码波动和重复报告带来的无效审计。此前工作提出 Scope+Offset 方法，基于 scope 与 offset 指纹识别漏洞，可减少约 30% 的无效审计，但 offset 分量对新增注释、空白等非功能性代码变更敏感，会造成虚假重复。本文提出 Scope+OffsetN，通过排除非功能性源代码行来归一化 offset 计算，并详述归一化算法。作者在示例上验证正确性；在针对性公开基准上，唯一指纹数量减少 43%。自 2025 年 5 月起，Scope+OffsetN 已部署于 GitLab，为每日数千次安全扫描提供跟踪。
In heterogeneous Static Application Security Testing (SAST) setups, multiple tools continuously monitor code changes to detect security vulnerabilities. Vulnerability Tracking deduplicates and tracks these vulnerabilities throughout a project’s lifetime, reducing futile auditing caused by code volatility and double reporting. In prior work, we introduced the Scope+Offset method which identifies vulnerabilities based on a scope and offset fingerprint, reducing futile auditing by approximately 30%. However, the offset component is sensitive to non-functional code changes such as added comments or whitespace, which can cause spurious duplication. In this paper, we present Scope+OffsetN, an improved method that normalizes the offset computation by excluding non-functional source code lines. We detail the normalization algorithm and demonstrate its correctness on worked examples; on a targeted public benchmark it reduces unique fingerprints by 43%. Scope+OffsetN has been deployed in GitLab since May 2025, providing tracking to thousands of daily security scans.