Web Application Data Flow Mapping for Security Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex web applications pose challenges in understanding data flow, making it difficult for security testers to identify and address security risks effectively, especially with the need for human intervention in specifying input and output pages during Dynamic Application Security Testing (DAST).
Innovation Solution
A system that analyzes data flow in complex web applications, generating a comprehensive data flow map to identify relationships between write and read requests, operating within the web layer without architectural changes, and non-intrusively mining the application's structure over time by inspecting HTTP requests and determining request types based on URL paths and data payloads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual testing is performed to ensure web application security, then security testing can be conducted, but the complexity of understanding data flow structure increases the difficulty and time required for testing
Solution Approach 1:
The patent introduces an intermediary system that automatically generates data flow maps from web application HTTP requests. This intermediary tool bridges the gap between complex application structures and human testers by visually representing data flow paths, write requests, and read requests without requiring manual analysis of the complex codebase.
Solution Approach 2:
The system enables self-service by automatically generating data flow maps through non-intrusive monitoring of HTTP requests. The application itself provides the data needed for analysis through its normal operation, eliminating the need for external manual code analysis while maintaining accuracy in security testing.
2Measurement precision
If comprehensive data flow analysis is performed to improve security testing, then security issues can be identified more effectively, but the time and resources required for analysis increase
Solution Approach 1:
The system performs preliminary action by automatically generating data flow maps before security testing begins. This pre-analysis creates a visual roadmap of data flow paths, write requests, and read requests, allowing testers to quickly understand application structure and focus their security testing efforts without spending time on manual code analysis.
Solution Approach 2:
The patent replaces manual mechanical analysis of code and data flow with an automated computational system that monitors HTTP requests and generates visual data flow maps. This substitution eliminates the time-consuming manual process while maintaining or improving analysis accuracy through systematic automated tracking.
3Ease of operation
If human intervention is used to specify input and output pages during DAST, then testing can be performed, but the reliance on human expertise increases the complexity and reduces testing speed
Solution Approach 1:
The system enables self-service by automatically generating data flow maps from web application HTTP requests. This automatic generation eliminates the need for human intervention in specifying input and output pages, as the system independently identifies and maps all data flow paths, write requests, and read requests through non-intrusive monitoring.
Solution Approach 2:
The patent replaces manual human analysis and specification of test parameters with an automated computational system that processes HTTP requests and generates comprehensive data flow maps. This substitution simultaneously improves ease of operation by removing the need for expert intervention and increases productivity by operating at machine speed.
Data Source
AI summary
Provided is a method and system for mapping a data flow of web-based application for use in testing. In one example, the method may include one or more of receiving, via a network, a plurality of uniform resource locator (URL) requests for an application that is hosted by a web server, identifying a set of read requests for the application and a set of write requests for the application, from among the received URL requests, generating a data flow mapping identifying which read requests from the set of read requests are associated with which write requests from the set of write requests based on data items accessed by the read requests and the write requests, and storing the generated data flow mapping within a storage device.