Runtime API Testing with Static Analysis for Complete Inventories

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing automated runtime API testing tools struggle to accurately build an API inventory due to limitations in observing runtime traffic and the infeasibility of procuring declarative specifications, leading to inaccurate test plans and security findings.

Innovation Solution

Integrate static source code analysis with runtime API testing by ingesting source code, conducting static analysis, and using machine learning models to match features from both static and runtime inventories, enhancing the API inventory and improving testing plans.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If runtime traffic inspection is used to build API inventory, then the tool can operate without source code access, but the accuracy and comprehensiveness of the API inventory deteriorates

Engineering Contradiction:

Improveability to operate without source codeVSAvoidAPI inventory accuracy

Core Design Contradiction:

Ease of operationVSMeasurement precision

Solution Approach 1:

The patent combines runtime traffic inspection with static source code analysis to build a comprehensive API inventory. The system merges dynamically observed APIs from runtime traffic with statically analyzed APIs from source code, creating a more complete and accurate inventory than either method could achieve alone. This resolves the contradiction by maintaining ease of operation through runtime inspection while improving accuracy through static analysis supplementation.

Inventive Principle:

Principle #5Merging (Combining)

Solution Approach 2:

The patent introduces a matching component as an intermediary that correlates APIs identified from runtime traffic with their corresponding source code locations. This intermediary process enables the system to leverage both runtime observation capabilities and static analysis accuracy, allowing the tool to operate autonomously while achieving high inventory precision through the mediating correlation process.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If static source code analysis is performed to improve API inventory accuracy, then the comprehensiveness of the inventory improves, but the complexity of the system increases

Engineering Contradiction:

ImproveAPI inventory accuracyVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The patent segments the API inventory building process into distinct components: runtime traffic inspection module, static source code analysis module, and API matching component. Each segment handles specific tasks independently, allowing the system to manage complexity through modular architecture while achieving comprehensive and accurate inventory results by combining the outputs of all segments.

Inventive Principle:

Principle #1Segmentation

3Reliability

If runtime traffic observation is used to identify APIs, then the tool can discover actual usage patterns, but it fails to identify APIs that are not yet called

Engineering Contradiction:

Improvediscovery of actual usage patternsVSAvoidability to identify uncalled APIs

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent performs preliminary static source code analysis to identify potential APIs before runtime execution occurs. By analyzing the source code structure in advance, the system can identify APIs that exist in the codebase but have not yet been called during runtime observation. This preliminary action ensures comprehensive coverage of both actually-used and potentially-unused APIs.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent merges the results of runtime traffic observation (which captures actual usage patterns) with static source code analysis (which identifies all potential APIs including uncalled ones). This combination resolves the contradiction by maintaining reliable discovery of actual usage while adding the versatility to identify APIs that exist in the code but haven't been invoked yet.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS20250328655A1Augmenting Automated Runtime API Testing with Static Analysis

Publication Date: 2025.10.23 APIIRO LTD

AI summary

A method for developing a testing plan for API endpoints including: ingesting source code of the API for which the security findings were found; conducting or importing static analysis on the ingested source code and returning static analysis API inventory; ingesting a runtime API inventory from a runtime traffic inspection of network traffic to the API endpoints; extracting a set of features from the static analysis API inventory; extracting a set of features from the runtime API inventory; comparing features from the set of features from the static analysis API inventory with features from the set of features from the runtime API inventory; outputting matched pairs of runtime API inventory and static analysis API inventory; and generating a runtime testing plan based on the runtime API inventory augmented with the static API inventory.