Web Application Testing via Fingerprint Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic web application testing is inefficient due to the vast number of web pages and testable elements, making it difficult to scan large web applications effectively.
Innovation Solution
A processor crawls web pages, detects testable elements, generates fingerprints, clusters similar pages, and tests a single page from each cluster, reducing the number of pages to be tested and predicting redundant requests to enhance efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all web pages are tested individually, then testing coverage is complete, but testing time and resources increase significantly
Solution Approach 1:
The patent merges similar web pages into clusters based on fingerprint matching. Pages within the same cluster share common testable elements and functionality, so testing one representative page from each cluster provides equivalent coverage to testing all pages individually, thereby reducing total testing time while maintaining comprehensive coverage.
Solution Approach 2:
The patent creates universal test cases that can be applied across multiple similar web pages within a cluster. A single test case designed for one representative page can be universally applied to other pages in the same cluster, eliminating redundant testing efforts and significantly reducing the overall testing workload.
2Measurement precision
If all testable elements on each web page are tested, then detection accuracy is high, but the number of tests to perform increases exponentially
Solution Approach 1:
The patent combines testable elements from similar web pages into unified test sets. By identifying common elements across clustered pages, the system creates consolidated test cases that detect vulnerabilities efficiently without missing any critical security issues, thus maintaining high detection accuracy while improving productivity.
Solution Approach 2:
The patent applies partial testing by selecting representative pages from each cluster rather than testing every page. This partial action approach focuses testing resources on the most critical and diverse pages, achieving sufficient detection accuracy without the exponential overhead of exhaustive testing of all pages.
3Reliability
If the testing system crawls and analyzes every web page, then comprehensive security detection is achieved, but system resource consumption increases
Solution Approach 1:
The patent merges the processing workload by clustering similar web pages together. The fingerprinting and analysis operations are performed once per cluster representative rather than per individual page, significantly reducing CPU, memory, and network resource consumption while still achieving comprehensive security detection across all pages in the application.
Data Source
AI summary
An example system includes a processor to crawl a plurality of web pages of a web application to be tested. The processor is to also receive an intercepted input to the web application and an output from a web application associated with each crawled web page. The processor is to further detect testable elements in the intercepted input and the output. The processor is also to generate a fingerprint for each web page based on the detected testable elements. The processor is to generate a list of clusters comprising one or more similar web pages based on the fingerprints. The processor is to test a single web page from each cluster.