Determine whether an appropriate defensive response was made by an application under test

Patent metadata

Field	Value
Publication number	US-10515220-B2
Application number	US-201415500523-A
Country	US
Kind code	B2
Filing date	Sep 25, 2014
Priority date	Sep 25, 2014
Publication date	Dec 24, 2019
Grant date	Dec 24, 2019

Abstract

Example embodiments disclosed herein relate to determining a secure activity of an application under test (AUT). Execution of an application under test is monitored. During an attack vector, an application programming interface associated with a secure activity is determined. A message is sent to a security test that secure activity occurred.

First claim

What is claimed is:

1. A method comprising:
monitoring, by a processor, execution of an application under test (AUT) to execute on a server during a dynamic security test of the AUT;
obtaining, by the processor, a predefined listing of a plurality of application programming interfaces (APIs) that are each known to be associated with a defensive mechanism in response to a security threat;
determining, by the processor, that an API from among the plurality of APIs was used during an attack vector of the dynamic security test; and
sending a message to the dynamic security test indicating that an appropriate defensive response to the attack vector was used by the AUT based on the determination that the API was used.

2. The method of claim 1 , further comprising:
receiving, from the dynamic security test, a type associated with the attack vector;
identifying the API from among the plurality of APIs based on the type; and
monitoring use of the identified API responsive to receiving the type.

3. The method of claim 2 , further comprising:
determining, at the dynamic security test, whether a vulnerability is detected in the AUT associated with the attack vector to generate vulnerability results.

4. The method of claim 3 , further comprising:
adding, to the vulnerability results, an indication that the API was used in response to the attack vector.

5. The method of claim 3 , wherein when the vulnerability is not detected, modifying, at the dynamic security test, future attack vectors based on a secure activity of the API.

6. The method of claim 1 , wherein the attack vector includes an attack to at least one of: Structured Query Language (SQL) injection, cross-site scripting, command injection, insecure randomness, header manipulation, and path manipulation.

7. A system comprising:
a processor; and
a non-transitory computer readable medium on which is stored instructions that when executed by the processor, cause the processor to:
receive, from a security test engine, a request that inquires whether a security activity of an application under test (AUT) occurred during an attack vector of a dynamic security test;
obtain a predefined listing of a plurality of application programming interfaces (APIs) that are each known to be associated with a defensive mechanism in response to a security threat;
determine that an API from among the plurality of APIs was used during the attack vector; and
send a message to the security test engine indicating that an appropriate defensive response to the attack vector was used during the attack vector.

8. The system of claim 7 , wherein the system includes the security test engine, and wherein the security test engine is to further send type information associated with the attack vector to a runtime agent executing at the processor, the runtime agent is further to identify and monitor use of the API based on the type information.

9. The system of claim 7 , wherein the system includes the security test engine, and wherein the security test engine is further to:
modify future attack vectors based on the indication that the appropriate defensive response was used.

10. The system of claim 9 , wherein to modify the future attack vectors, the security test engine is further to:
map a function call by the API with a field that is subject to the attack vector; and
ignore the field in the future attack vectors.

11. The system of claim 7 , wherein to send the message, the instructions, when executed by the processor, further cause the device to:
generate a trace response that includes a trace that associates an application request from the attack vector with a response to the application request from the AUT, the message including the trace response.

12. The system of claim 7 , wherein the system includes the security test engine, and wherein the security test engine is to further generate a vulnerability report for the dynamic security test.

13. The system of claim 12 , wherein to generate the vulnerability report, the security test engine is further to include a reporting that the appropriate defensive response to the attack vector was used.

14. The system of claim 9 , wherein to modify the future attack vectors, the security test engine is further to:
identify attack vectors among the future attack vectors that are known to be blocked by use of the API; and
ignore the identified attack vectors.

15. The system of claim 7 , wherein the attack vector includes an attack to at least one of: Structured Query Language (SQL) injection, cross-site scripting, command injection, insecure randomness, header manipulation, and path manipulation.

16. A non-transitory machine-readable storage medium storing instructions that, when executed by a processor of a device, cause the device to:
monitor execution of an application under test (AUT) to execute on a server during a dynamic security test of the AUT;
receive an indication that an attack vector is to be performed on the AUT;
obtain a predefined listing of a plurality of application programming interfaces (APIs) that are each known to be associated with a defensive mechanism in response to a security threat;
determine that an API from among the plurality of APIs was used during the attack vector; and
send a message to the dynamic security test indicating that an appropriate defensive response to the attack vector was used by the AUT based on the determination that the API was used.

17. The non-transitory machine-readable storage medium of claim 16 , further comprising instructions that, when executed by the processor, cause the device to:
determine that the attack vector was unsuccessful, wherein the message is sent responsive to the determination that the attack vector was unsuccessful.

18. The non-transitory machine-readable storage medium of claim 16 , wherein an agent executing on the device monitors the AUT and determines that the API was used.

19. The system of claim 7 , wherein the instructions, when executed by the processor, further cause the device to:
receive, from the security test engine, an indication of a type of vulnerability that the attack vector is to attempt to find;
identify a first defensive mechanism that is to respond to the type of vulnerability;
identify the plurality of APIs associated with the first defense mechanism; and
monitor the plurality of APIs.

20. The system of claim 19 , wherein to receive the indication of the type of vulnerability, the instructions, when executed by the processor, further cause the device to:
parse a custom header of an application request from the security test engine.

Assignees

• Entit Software Llc
• Micro Focus Llc

Inventors

• Ng Sam
• Sechman Ronald J
• Madou Matias

Classifications

• G06F2221/033

  Test or assess software · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• G06F11/3692

  for test results analysis · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title