Automated Cybersecurity Testing Through Error-Driven Input Discovery

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cyber security testing methods fail to effectively determine meaningful inputs for authorized services and analyze system messages to identify security vulnerabilities, leading to incomplete testing of code paths and potential integrity breaches.

Innovation Solution

A cyber security testing tool that analyzes system-level error messages to identify missing inputs and potential vulnerabilities by issuing calls to authorized services, intercepting error messages, and reissuing calls with determined inputs, thereby enhancing the testing process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If automated testing tools issue calls to authorized services without analyzing system messages, then testing speed is maintained, but testing completeness and vulnerability detection capability deteriorate

Engineering Contradiction:

Improvetesting speedVSAvoidtesting completeness

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The test tool captures system-level error messages returned by authorized services and uses this feedback information to automatically determine missing inputs and reissue calls with appropriate parameters, creating a closed-loop testing process that improves both completeness and efficiency

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The testing tool autonomously analyzes system messages, determines missing inputs, and reissues calls without human intervention, enabling the system to self-correct and self-improve its testing coverage automatically

Inventive Principle:

Principle #25Self-service

2Measurement precision

If test tools manually determine missing inputs for authorized services, then input accuracy is improved, but testing time and operational complexity increase

Engineering Contradiction:

Improveinput accuracyVSAvoidtesting time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The test tool automatically analyzes system error messages to determine missing inputs and reissues calls without manual intervention, eliminating the time-consuming manual process while maintaining high input accuracy through systematic message parsing and pattern recognition

Inventive Principle:

Principle #25Self-service

3Speed

If authorized services do not verify input from unauthorized programs, then service response speed is maintained, but system integrity and security deteriorate

Engineering Contradiction:

Improveservice response speedVSAvoidsystem integrity

Core Design Contradiction:

SpeedVSObject-affected harmful factors

Solution Approach 1:

The test tool captures and analyzes system-level error messages returned by authorized services, using this feedback to automatically determine missing inputs and reissue calls with appropriate parameters, creating a closed-loop testing process

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS12361137B2Cyber security testing with automated system message processing for input and result determination

Publication Date: 2025.07.15 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Cyber security testing with automated system message processing for input and result determination is disclosed, including issuing, by a test tool, a call to an authorized service; identifying, by the test tool, one or more system-level error messages generated after issuing the call; determining, by the test tool based on at least one first system-level error message, a missing input for the call to the authorized service; and reissuing, by the test tool, the call to the authorized service with the missing input.