Intelligent Dynamic Application Security Testing via API Trace Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional dynamic application security testing (DAST) is time-consuming and lacks insight into the web application being tested, making it inefficient for use during application development, and existing technologies like Static Application Security Testing (SAST) and Interactive Application Security Testing (IAST) have their own set of challenges such as being processor-consuming and language-dependent.
Innovation Solution
Intelligent and directed dynamic application security testing (ID-DAST) eliminates the crawling phase by using automated analysis of API traces or code changes to determine attack locations and types, allowing for targeted and efficient vulnerability testing through an ID-DAST platform that provides payloads for specific attacks and verifies their success using machine learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Manufacturing precision
If traditional DAST crawls the web-application page-by-page, form-by-form, and link-by-link to discover potential attack locations, then the testing coverage is improved, but the testing time becomes extremely time-consuming
Solution Approach 1:
The patent applies preliminary action by performing static analysis and API trace analysis before the actual attack phase to pre-identify potential attack locations and types. This allows the system to skip the time-consuming crawling phase while still maintaining comprehensive testing coverage, as the attack locations are determined in advance through code analysis and API monitoring.
Solution Approach 2:
The patent extracts and removes the crawling phase from the traditional DAST process entirely. By separating the attack location discovery from the crawling mechanism and replacing it with static analysis and API trace analysis, the system eliminates the time-consuming navigation through pages, forms, and links while preserving the ability to identify vulnerable locations.
2Reliability
If traditional DAST launches an excessive number of time-consuming attacks to compensate for lack of application insight, then the probability of finding exploits is improved, but the testing efficiency deteriorates
Solution Approach 1:
The patent implements feedback mechanisms where the system continuously monitors API traces and code changes during application execution, using this information to dynamically adjust and refine attack location identification and attack type selection. This feedback loop enables the system to focus attacks on the most promising targets rather than launching excessive random attacks, improving both reliability and efficiency.
Solution Approach 2:
By performing static analysis and API trace analysis beforehand, the system preliminarily identifies the most likely attack locations and types, allowing it to launch targeted attacks rather than excessive random ones. This preliminary characterization of the application significantly improves exploit detection rate while reducing the total number of attacks needed.
3Manufacturing precision
If SAST scans and analyzes the entire source code, bytecode or binary code to find vulnerabilities, then the vulnerability detection capability is improved, but the processing time becomes time-consuming
Solution Approach 1:
The patent segments the code analysis process by focusing static analysis on specific security-relevant portions of the code rather than analyzing the entire codebase. By combining this segmented static analysis with runtime API trace monitoring, the system achieves comprehensive vulnerability detection capability while significantly reducing processing time compared to full-code SAST scanning.
4Manufacturing precision
If IAST utilizes an agent to provide security analysis on an application, then the security analysis capability is improved, but the application stability may be negatively impacted
Solution Approach 1:
The patent uses API traces as an intermediary to capture application behavior without requiring direct instrumentation of the application runtime environment. By monitoring API calls and their parameters/return values, the system achieves comprehensive security analysis capability while avoiding the stability issues associated with IAST agents that instrument into the JVM or runtime environment.
5Ease of operation
If IAST uses the same processor that runs the application, then the security analysis is performed in-place, but the application behavior may be impacted
Solution Approach 1:
The patent segments the analysis workload by performing static analysis separately from runtime monitoring. The static analysis phase processes code without affecting application behavior, while the runtime phase monitors API traces with minimal overhead. This segmentation allows in-place security analysis while preserving application behavior, avoiding the processor contention and behavior impact issues of traditional IAST.
Data Source
AI summary
Disclosed are systems, methods and computer readable mediums for intelligent and directed dynamic application security testing. The systems, methods and computer-readable mediums can be configured to receive an attack location and an attack type for a web-application, transmit the attack location and attack type to a ID-DAST platform, receive from the ID-DAST platform a payload, attack the web-application using the payload, and receive results of the attack.