Automated Security Testing via Functional Test Conversion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for testing software applications for security vulnerabilities are inefficient and require substantial time, resources, and specialized training, as they often rely on manual processes and lack automated integration with existing quality assurance testing scenarios.
Innovation Solution
The integration of an Interactive Application Security Testing (IAST) system that automatically records, optimizes, and modifies functional test scenarios to include malicious payloads, allowing for the detection of security vulnerabilities by applying these modified tests to the software application, with instrumentation to identify and report suspicious behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual security testing methods are used, then security vulnerabilities can be detected, but the testing process requires substantial time, resources, and specialized training
Solution Approach 1:
The system enables automated self-testing by recording functional test scenarios and automatically generating corresponding security test scenarios with malicious payloads, eliminating the need for manual security testing expertise and reducing testing time while maintaining detection reliability
Solution Approach 2:
The system performs preliminary recording of functional test scenarios during normal application operation, storing these scenarios for later automatic conversion into security test scenarios, thereby preparing testing data in advance without interrupting application functionality
2Reliability
If comprehensive functional test scenarios are recorded and converted to security tests, then security vulnerability detection capability is enhanced, but the complexity of the testing system increases
Solution Approach 1:
The system uses a universal recording mechanism that captures functional test scenarios applicable to any application, then automatically converts these scenarios into security test scenarios with malicious payloads, providing multi-functional capability (recording, conversion, execution) through a single integrated system that manages complexity internally
Solution Approach 2:
The system introduces an intermediary conversion layer that translates recorded functional test scenarios into security test scenarios with malicious payloads, mediating between simple functional testing and complex security testing without requiring the user to directly manage the complexity of payload generation and injection
3Productivity
If existing quality assurance test scenarios are integrated with security testing, then testing efficiency is improved, but the difficulty of integrating multiple testing frameworks increases
Solution Approach 1:
The system merges functional testing and security testing into a unified framework by recording functional test scenarios and automatically generating corresponding security test scenarios, combining the benefits of both testing approaches while managing integration complexity through automated scenario conversion
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for testing a software application program (22) includes recording a sequence of functional tests (28) that are applied to the program and automatically identifying and collapsing sessions within the recorded functional tests. Modified tests are created by replacing parameters in the collapsed sessions with malicious inputs. The modified tests are applied to the program in order to detect security vulnerabilities in the program.