Local Data-Checking Software for Test Payload Filtering

Solution Overview

Problem

Current dynamic analysis tools for testing computer software applications are inefficient in detecting security vulnerabilities due to high costs associated with sending numerous HTTP requests, often resulting in undetected vulnerabilities as they typically send only a few dozen test payloads per HTTP parameter.

Innovation Solution

A method involving configuring a computer to execute data-checking software, processing test data payloads to determine if they are endorsed for further processing, and then sending only those payloads that are likely to expose security vulnerabilities via a computer network to the software application, thereby optimizing the testing process.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If all possible test data payloads are sent to test for all security vulnerabilities, then detection completeness is improved, but network bandwidth consumption and time cost increase significantly

Engineering Contradiction:

Improvedetection completenessVSAvoidnetwork bandwidth consumption

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The patent applies preliminary action by executing data-checking software locally on the tester's computer before sending test payloads. This pre-processing filters out payloads that would be blocked by the application's data validation, so only potentially successful payloads are transmitted over the network. The local execution of validation logic allows the system to anticipate which payloads would be rejected, eliminating wasteful network traffic for those cases.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses copying by creating and executing a local copy of the application's data-checking software on the tester's system. This copy mirrors the validation logic of the target application, allowing the tester to simulate data validation locally without actually sending test payloads to the remote application. The local copy enables filtering and selection of test payloads based on predicted validation outcomes.

Inventive Principle:

Principle #26Copying

2Reliability

If all possible test data payloads are sent to test for all security vulnerabilities, then detection completeness is improved, but time consumption increases significantly

Engineering Contradiction:

Improvedetection completenessVSAvoidtime consumption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by executing data-checking software locally on the tester's computer before sending test payloads. This pre-processing filters out payloads that would be blocked by the application's data validation, so only potentially successful payloads are transmitted over the network. The local execution of validation logic allows the system to anticipate which payloads would be rejected, eliminating wasteful network traffic for those cases.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses copying by creating and executing a local copy of the application's data-checking software on the tester's system. This copy mirrors the validation logic of the target application, allowing the tester to simulate data validation locally without actually sending test payloads to the remote application. The local copy enables filtering and selection of test payloads based on predicted validation outcomes.

Inventive Principle:

Principle #26Copying

3Loss of energy

If only a few dozen test payloads are sent per HTTP parameter to reduce costs, then network bandwidth consumption is reduced, but detection completeness deteriorates

Engineering Contradiction:

Improvenetwork bandwidth consumptionVSAvoiddetection completeness

Core Design Contradiction:

Loss of energyVSReliability

Solution Approach 1:

The patent applies preliminary action by executing data-checking software locally on the tester's computer before sending test payloads. This pre-processing filters out payloads that would be blocked by the application's data validation, so only potentially successful payloads are transmitted over the network. The local execution of validation logic allows the system to anticipate which payloads would be rejected, eliminating wasteful network traffic for those cases.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses copying by creating and executing a local copy of the application's data-checking software on the tester's system. This copy mirrors the validation logic of the target application, allowing the tester to simulate data validation locally without actually sending test payloads to the remote application. The local copy enables filtering and selection of test payloads based on predicted validation outcomes.

Inventive Principle:

Principle #26Copying

Data Source

PatentUS9135153B2Optimizing test data payload selection for testing computer software applications via computer networks

Publication Date: 2015.09.15 HCL TECH LTD

AI summary

Testing a computer software application by configuring a first computer to execute a copy of data-checking software used by a computer software application at a second computer, processing a first copy of a test data payload using the data-checking software at the first computer, where the test data payload is configured to test for an associated security vulnerability, determining that the first copy of the test data payload is endorsed by the data-checking software at the first computer for further processing, and sending a second copy of the test data payload via a computer network to the computer software application at the second computer for processing threat.