Automated Security Testing via Functional Test Conversion

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Current methods for testing software applications for security vulnerabilities are inefficient and require substantial time, resources, and specialized training, as they often rely on manual processes and lack automated integration with existing quality assurance testing scenarios.

Innovation Solution

The integration of an Interactive Application Security Testing (IAST) system that automatically records, optimizes, and modifies functional test scenarios to include malicious payloads, allowing for the detection of security vulnerabilities by applying these modified tests to the software application, with instrumentation to identify and report suspicious behavior.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If manual security testing methods are used, then security vulnerabilities can be detected, but the testing process requires substantial time, resources, and specialized training

Engineering Contradiction:
Improvesecurity vulnerability detectionVSAvoidtesting time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The system enables automated self-testing by recording functional test scenarios and automatically generating corresponding security test scenarios with malicious payloads, eliminating the need for manual security testing expertise and reducing testing time while maintaining detection reliability

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system performs preliminary recording of functional test scenarios during normal application operation, storing these scenarios for later automatic conversion into security test scenarios, thereby preparing testing data in advance without interrupting application functionality

Inventive Principle:
Principle #10Preliminary action

2Reliability

If comprehensive functional test scenarios are recorded and converted to security tests, then security vulnerability detection capability is enhanced, but the complexity of the testing system increases

Engineering Contradiction:
Improvesecurity vulnerability detection capabilityVSAvoidtesting system complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The system uses a universal recording mechanism that captures functional test scenarios applicable to any application, then automatically converts these scenarios into security test scenarios with malicious payloads, providing multi-functional capability (recording, conversion, execution) through a single integrated system that manages complexity internally

Inventive Principle:
Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system introduces an intermediary conversion layer that translates recorded functional test scenarios into security test scenarios with malicious payloads, mediating between simple functional testing and complex security testing without requiring the user to directly manage the complexity of payload generation and injection

Inventive Principle:
Principle #24Intermediary (Mediator)

3Productivity

If existing quality assurance test scenarios are integrated with security testing, then testing efficiency is improved, but the difficulty of integrating multiple testing frameworks increases

Engineering Contradiction:
Improvetesting efficiencyVSAvoidintegration complexity
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The system merges functional testing and security testing into a unified framework by recording functional test scenarios and automatically generating corresponding security test scenarios, combining the benefits of both testing approaches while managing integration complexity through automated scenario conversion

Inventive Principle:
Principle #5Merging (Combining)

Data Source

PatentEP3433782B1Integrated interactive application security testing
Publication Date: 2020.09.30 CHECKMARX LTD
  • EP3433782B1 patent drawingFigure 1
  • EP3433782B1 patent drawingFigure 2
  • EP3433782B1 patent drawingFigure 3

AI summary

A method for testing a software application program (22) includes recording a sequence of functional tests (28) that are applied to the program and automatically identifying and collapsing sessions within the recorded functional tests. Modified tests are created by replacing parameters in the collapsed sessions with malicious inputs. The modified tests are applied to the program in order to detect security vulnerabilities in the program.