Real-Time Modifier for Application Security Testing Stability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional black-box security testing for web applications can cause disruptions and damage to the Application Under Test (AUT) due to its unawareness of the application's logic, leading to time-consuming sandboxing, potential test failures, and missed critical vulnerabilities.
Innovation Solution
Implementing a real-time modifier environment that monitors and modifies the execution of the AUT by instrumenting APIs, allowing safe operations to be emulated or blocked, ensuring the application remains stable while identifying vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional black-box security testing is performed by a scanner that poses as an attacker, then vulnerabilities can be identified through HTTP requests and responses, but the application under test may experience disruptions, damage, crashes, or become non-responsive due to the scanner's unawareness of the application's logic
Solution Approach 1:
The patent introduces a real-time modifier as an intermediary component that sits between the security scanner and the application under test. This modifier monitors scanner actions and modifies them in real-time to prevent harmful operations while allowing safe testing to proceed. The intermediary enables the scanner to continue its vulnerability identification mission while protecting the application from crashes and disruptions caused by aggressive scanning techniques.
Solution Approach 2:
The real-time modifier performs preliminary anti-action by preemptively blocking or modifying scanner requests that are likely to cause harmful effects before they reach the application. By analyzing scanner behavior patterns and application state, the modifier prevents actions that would lead to crashes, data loss, or service disruption, while still allowing legitimate security testing to occur.
2Productivity
If aggressive security testing is performed to thoroughly identify vulnerabilities, then more security issues can be discovered, but the application may crash or become non-responsive, causing test failures and requiring time-consuming sandboxing
Solution Approach 1:
The real-time modifier performs preliminary protective actions by setting up monitoring and control mechanisms before aggressive scanning begins. It proactively identifies potential harmful operations and prevents them before they can cause crashes or require sandboxing. This preliminary protection enables more aggressive and thorough vulnerability scanning to proceed without the time losses associated with test failures and recovery.
Solution Approach 2:
The system implements feedback loops where the real-time modifier continuously monitors the application's response to scanner actions and adjusts its modifications in real-time. When the application shows signs of stress or instability, the modifier reduces the aggressiveness of allowed scanning operations. This feedback mechanism maintains high vulnerability discovery rates while preventing crashes that would lead to time-consuming test interruptions and sandboxing requirements.
3Adaptability or versatility
If the scanner explores the application by making HTTP requests without awareness of application logic, then the attack surface can be mapped and vulnerabilities diagnosed, but disruptive operations may occur that damage the application or its environment
Solution Approach 1:
The real-time modifier serves as an intermediary that filters and modifies scanner requests based on their potential harm. It maintains comprehensive testing coverage by allowing diverse scanning operations while blocking or modifying those that would cause application damage, data loss, or environmental disruption. The intermediary enables the scanner to explore the full attack surface without directly causing harmful effects.
Solution Approach 2:
The real-time modifier applies different levels of modification to different scanner requests based on their specific characteristics and potential impact. Safe requests are allowed to pass through unchanged, while potentially harmful requests are modified or blocked. This localized quality control enables comprehensive testing coverage while preventing specific harmful operations from reaching the application.
Data Source
AI summary
Example embodiments disclosed herein relate to real-time modification of an application under test (AUT). A security rest is performed on the AUT. A real-time modifier determines that a portion of a function to be executed by the AUT is unsafe. The real-time modifier modifies execution of the AUT to not execute the portion.