Automated Mobile App Security Testing via API Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile applications and backend servers are often prone to security weaknesses and cyber attacks due to the lack of thorough security analysis, as they are frequently developed and distributed without adequate testing for vulnerabilities.
Innovation Solution
A system comprising a processor and memory that analyzes computer instructions of mobile applications to determine identifier patterns for server endpoints, performs security tests on backend servers, and generates security reports to identify and mitigate potential threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If automated security testing is implemented, then security vulnerability detection capability is improved, but system complexity increases
Solution Approach 1:
The security testing system is divided into distinct functional modules: an analysis component that extracts identifier patterns from mobile application code, and a security component that executes penetration tests using these patterns. This segmentation allows each module to specialize in specific tasks, improving detection capability while managing overall system complexity through modular design.
Solution Approach 2:
The analysis component performs preliminary extraction of identifier patterns (URLs, API endpoints, database connection strings) from the mobile application's compiled code before the penetration testing phase. This preliminary action prepares the necessary test targets in advance, enabling the security component to conduct comprehensive automated testing without manually analyzing the entire application codebase.
2Measurement precision
If comprehensive security analysis is performed on mobile applications, then security testing accuracy is improved, but processing time increases
Solution Approach 1:
The system extracts and copies relevant identifier patterns (URLs, API endpoints, database connection strings) from the mobile application's compiled bytecode without requiring full decompilation or manual code review. This copying approach captures essential security test targets efficiently, maintaining high detection accuracy while significantly reducing the time required compared to comprehensive manual analysis.
Data Source
AI summary
Techniques that facilitate automated security testing of one or more mobile applications and/or one or more backend servers for the one or more mobile applications are provided. In one example, a system includes an analysis component and a security component. The analysis component can analyze computer instructions of a mobile application. The analysis component can also determine an identifier pattern comprising an application programming interface for one or more server endpoints associated with the mobile application. The security component can perform a security test for a server device based on the identifier pattern for the one or more server endpoints.