Web Service Testing Infrastructure Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Designing a suitable test strategy for web services to effectively simulate attacks and expose vulnerabilities is challenging, as existing methods lack guidance on structuring test routines to optimize coverage and accuracy, potentially leading to insecure services being released.
Innovation Solution
A computer-implemented method that infers the web service infrastructure by analyzing the Web Service Description Language (WSDL) file and URL, identifying design technology and provider fingerprints, and generating hosting information to design a targeted security test.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If a generic web service testing framework is used, then the testing process is simple to implement, but the test coverage and accuracy are insufficient to effectively expose vulnerabilities
Solution Approach 1:
The system performs preliminary actions by automatically inferring the web service infrastructure (technology stack, framework, server type) before designing and executing security tests. This preliminary characterization enables the selection of appropriate test strategies and attack vectors specific to the inferred infrastructure, thereby improving test coverage and accuracy without manual configuration
Solution Approach 2:
The system changes the parameter of test strategy by adapting it based on the inferred web service infrastructure. Different infrastructure types (e.g., .NET, Java, PHP) receive different test configurations and attack patterns. This dynamic parameter adjustment allows the same testing framework to achieve high accuracy across diverse web services while maintaining ease of implementation
2Measurement precision
If manual test strategy design is performed to optimize coverage and accuracy, then test precision improves, but the complexity and time required for test design increases significantly
Solution Approach 1:
The system applies self-service by automatically inferring the web service infrastructure and generating an appropriate test strategy without requiring manual analysis or configuration by security testers. The system serves itself by characterizing the target web service and selecting optimal test approaches, thereby achieving high test precision while eliminating the complexity of manual test design
Solution Approach 2:
The infrastructure inference module acts as an intermediary between the generic testing framework and the specific web service being tested. It analyzes the web service characteristics and translates them into appropriate test configurations, bridging the gap between generic testing capabilities and specific security requirements without requiring manual intervention
3Ease of operation
If protocol information from packet headers is used for testing, then the testing process is straightforward, but the information obtained about web service structure is limited and provides little guidance for optimizing test routines
Solution Approach 1:
The system performs preliminary infrastructure characterization by inferring the web service technology stack, framework, and server type before executing security tests. This preliminary action goes beyond simple protocol detection to gather comprehensive structural information that guides subsequent test design, maintaining operational simplicity while reducing information loss
Solution Approach 2:
The system transitions from one-dimensional protocol detection to multi-dimensional infrastructure analysis by inferring technology stack, framework, server type, and other structural characteristics. This dimensional expansion provides rich guidance for test routine optimization while preserving the simplicity of automated execution through programmatic infrastructure inference
Data Source
AI summary
Disclosed is a computer-implemented method and system of inferring a web service infrastructure from a web service hosted on a web server. The method includes: downloading a web service description language (WSDL) file describing the web service from a location on the web server identified by a uniform resource locator (URL); identifying at least one of a web service design technology and a web service design technology provider from character strings indicative of the technology and implementation, respectively, in at least one of the URL and WSDL file; and inferring the web service infrastructure from the identified web service design technology and web service design technology provider. A computer program product having aspects of the method as program code is also disclosed.