Dynamic Website Security Testing via Runtime Behavior Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting website vulnerabilities, such as SQL injection, XSS, command injection, and CSRF, are inadequate as they often require manual analysis and cannot identify malicious scripts injected into trusted libraries, especially those using obfuscation techniques, which static analysis may miss.
Innovation Solution
A system and method for automatically detecting malicious third-party and first-party scripts by simulating user interactions on a website, generating logs of dynamic behavior, and applying predefined rules to identify potential security anomalies, including obfuscation, encryption, and sensitive information requests, without modifying the website code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static analysis is used to detect website vulnerabilities, then the detection process is simple and fast, but malicious scripts using obfuscation techniques cannot be identified
Solution Approach 1:
The patent transitions from static code analysis to dynamic runtime analysis. The system instruments the website code to execute in a controlled runtime environment, monitoring actual execution behavior rather than just analyzing code structure. This dynamic approach allows detection of obfuscated malicious scripts by observing their runtime actions, such as unauthorized data access or communication with external servers, which static analysis cannot detect.
Solution Approach 2:
The patent introduces a runtime testing environment as an intermediary between the website code and the analysis system. This environment acts as a mediator that executes the instrumented code and captures its behavior, allowing indirect observation of malicious activities without directly modifying or executing the original production code. The intermediary environment enables safe monitoring of dynamic behavior while maintaining isolation from the actual website.
2Measurement precision
If manual analysis of website code is performed, then vulnerabilities can be identified, but the process is time-consuming and labor-intensive
Solution Approach 1:
The patent implements automated self-testing of website code through instrumentation. The system automatically inserts monitoring code into the website's execution flow, enabling the code to self-report its behavior during runtime. This automated self-service approach eliminates the need for manual code review while maintaining comprehensive vulnerability detection, as the instrumented code automatically tracks and reports suspicious activities without human intervention.
Solution Approach 2:
The patent establishes a feedback loop where the runtime monitoring system continuously observes code execution and automatically compares behavior against security policies. When anomalies are detected, the system generates alerts and can trigger automated responses. This continuous feedback mechanism replaces manual analysis by providing real-time, automated vulnerability detection that scales without additional time investment.
3Difficulty of detecting and measuring
If the website code is modified for testing purposes, then dynamic behavior can be observed, but the original website integrity is compromised
Solution Approach 1:
The patent uses a runtime testing environment as an intermediary that executes instrumented versions of the website code in isolation. The original production code remains unmodified and untouched, while the intermediary environment runs replicated or copied code with monitoring instrumentation. This approach enables comprehensive behavior observation without compromising the integrity or stability of the original website code.
Solution Approach 2:
The patent creates copies of the website code for runtime testing purposes. Instead of modifying the original production code, the system replicates the code into a testing environment where instrumentation can be safely applied. These copies serve as test subjects that mirror the original code's behavior while allowing unrestricted monitoring and analysis, thus preserving the original code's integrity while enabling detailed behavior observation.
Data Source
AI summary
A website anomaly test is performed by automatically checking that a website has not been compromised by malicious code. A system can test a dynamic behavior of a website that indicates a functional user flow through the website. A set of rules are applied against a log of dynamic behavior of the website, as well as static code of the website, to identify potential compromise by malicious scripts.