Dynamic Security Test Sequencing for Application Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security testing methods fail to accurately simulate human-driven attempts to obtain unauthorized control or access to applications, as they are typically run in isolation and do not effectively test logic within the application, leading to incomplete vulnerability identification.
Innovation Solution
A system that performs dynamically linked security tests, where the results of one test are used to determine the order and sequence of subsequent tests, simulating methods for obtaining unauthorized access by linking security tests based on identified weaknesses, and using a database of security test sequences to dynamically adjust the testing process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security tests are performed individually in isolation, then each test can be executed independently and simply, but the testing cannot accurately simulate human-driven attempts to obtain unauthorized control or access to applications
Solution Approach 1:
The patent implements dynamic security test sequencing where the system adapts the testing process based on results from previous tests. The test sequence is not fixed but dynamically adjusted to simulate human-driven attack patterns, allowing the system to evolve its approach based on identified vulnerabilities and application responses.
Solution Approach 2:
The patent divides the security testing process into multiple individual test cases that can be executed in a sequence. Each test represents a discrete security check that can be independently defined and executed, yet when linked together in sequences, they form a comprehensive simulation of unauthorized access attempts.
2Reliability
If individual security tests are performed in isolation, then the testing process is simple to execute, but vulnerabilities that occur post-deployment cannot be effectively identified
Solution Approach 1:
The patent performs preliminary security tests to identify initial vulnerabilities, then uses those results to determine subsequent tests to execute. This preliminary action approach allows the system to adaptively explore potential attack vectors based on early findings, improving vulnerability identification without requiring complete re-testing.
Solution Approach 2:
The system implements feedback loops where results from each security test are analyzed and used to determine the next test to execute. This feedback mechanism allows the testing process to learn from previous outcomes and adjust its approach, identifying vulnerabilities that would remain hidden in static, pre-defined test sequences.
3Reliability
If security tests are linked dynamically based on test results, then comprehensive vulnerability identification is achieved, but the complexity of managing test sequences increases
Solution Approach 1:
The patent introduces an intermediary component that manages the linking and sequencing of security tests based on results from previous tests. This intermediary layer handles the complexity of dynamic test sequence management, allowing individual test cases to remain simple while the overall system achieves comprehensive vulnerability identification through intelligent test linking.
Data Source
AI summary
Systems, computer program products, and methods are described herein for testing an application with dynamically linked security tests. The present invention may be configured to perform, using a request engine, based on the first data, and based on test protocols stored in a first data structure, a first security test on an application. The present invention may be further configured to determine, based on determining that the application failed the first security test and based on a second data structure, whether the first security test is linked to one or more other security tests, where the second data structure includes security test sequences linking security tests and/or data to transmit from the first security test to the one or more other security tests, and provide, to the first queue, one or more other security tests to which the first security test is linked.