Computer software application self-testing

Patent metadata

Field	Value
Publication number	US-9256511-B2
Application number	US-201213602559-A
Country	US
Kind code	B2
Filing date	Sep 4, 2012
Priority date	Sep 4, 2012
Publication date	Feb 9, 2016
Grant date	Feb 9, 2016

Abstract

Testing a computer software application by detecting an arrival of input data provided as input to a computer software application from a source external to the computer software application, modifying the detected input data to include test data configured to test the computer software application in accordance with a predefined test, thereby creating a modified version of the detected input data, and processing the modified version of the detected input data, thereby performing the predefined test on the computer software application using the test data.

First claim

What is claimed is:

1. A method for testing a computer software application, the method comprising:
instrumenting the computer software application to detect an arrival of input data provided as input to the computer software application from a source external to the computer software application;
modifying the detected input data using a processor to include test data configured to perform a test for a known type of security vulnerability on the computer software application, thereby creating a modified version of the detected input data; and
processing the modified version of the detected input data, to perform the test on the computer software application using the test data; and, wherein
the detecting, modifying, and processing are performed by the computer software application
analyzing results of the test responsive to the computer software application performing the test using the test data, wherein,
the detected input data is modified a plurality of instance with each instance including different test data, and
the processing is performed on each of the plurality of instances.

2. The method according to claim 1 and further comprising
instrumenting the computer software application to perform the modifying.

3. The method according to claim 1 wherein
the detecting comprises detecting wherein the computer software application is a web application and wherein the detected input data is an HTTP request.

4. The method according to claim 1 wherein the modifying comprises modifying wherein the test is designed to test for a known type of security vulnerability, and wherein the test data includes a malicious payload designed to exploit the security vulnerability.

5. The method according to claim 1 and further comprising:
performing the modifying a plurality of times using different test data during each of the times, thereby creating a plurality of modified versions of the detected input data; and
performing the processing for each of the modified versions of the detected input data.

6. A method for testing a computer software application, the method comprising:
instrumenting a computer software application using a processor to
detect an arrival of input data provided as input to the computer software application from a source external to the computer software application,
modify the detected input data to include test data configured to perform a test for a known type of security vulnerability on the computer software application, thereby creating a modified version of the detected input data, and
process the modified version of the detected input data, to perform the test on the computer software application using the test data; and

analyzing results of the test responsive to the computer software application performing the predefined test using the test data, wherein
the detected input data is modified a plurality of instances with each instance including different test data, and
the process is performed on each of the plurality of instance.

7. The method according to claim 6 wherein
the instrumenting comprises instrumenting wherein the computer software application is a web application and wherein the detected input data is an HTTP request.

8. The method according to claim 6 wherein
the instrumenting comprises instrumenting the computer software application to modify the detected input data wherein the predefined test is designed to test for a known type of security vulnerability, and wherein the test data includes a malicious payload designed to exploit the security vulnerability.

9. The method according to claim 6 wherein the instrumenting comprises instrumenting the computer software application to modify the detected input data a plurality of times using different test data during each of the times, thereby creating a plurality of modified versions of the detected input data, and process each of the modified versions of the detected input data.

10. A system for testing a computer software application, the system comprising:
a processor configured to initiate executable operations comprising:
instrumenting the computer software application to detect an arrival of input data provided as input to the computer software application from a source external to the computer software application;
modifying the detected input data using a processor to include test data configured to perform a test for a known type of security vulnerability on the computer software application, thereby creating a modified version of the detected input data; and
processing the modified version of the detected input data, to perform the test on the computer software application using the test data, wherein
the detecting, modifying, and processing are performed by the computer software application;
analyzing results of the test response to the computer software application performing the test using the test data, wherein
the detected input data is modified a plurality of instances with each instance including different test data, and
the processing is performed on each of the plurality of instances.

11. The system according to claim 10 wherein
the computer software application is instrumented to perform the modifying.

12. The system according to claim 10 wherein
the computer software application is a web application and wherein the detected input data is an HTTP request.

13. The system according to claim 10 wherein
the test is designed to test for a known type of security vulnerability, and wherein the test data includes a malicious payload designed to exploit the security vulnerability.

14. The system according to claim 10 wherein
the processor is further configured to initiate executable operations comprising:
performing the modifying a plurality of times using different test data during each of the times, thereby creating a plurality of modified versions of the detected input data; and
performing the processing for each of the modified versions of the detected input data.

15. A system for testing a computer software application, the system comprising:
a processor configured to initiate executable operations comprising:
instrumenting the computer software application to detect an arrival of input data provided as input to the computer software application from a source external to the computer software application,
modifying the detected input data to include test data configured to perform a test for a known type of security vulnerability one the computer software application, thereby creating a modified version of the detected input data, and
processing the modified version of the detected input data, to perform the predefined test on the computer software application using the test data; and
analyzing results of the test responsive to the computer software application performing the test using the test data, wherein
the detected input data is modified a plurality of instance with each instance including different test data, and
the processing is performed on each of the plurality of instances.

16. The system according to claim 15 wherein the computer software application is a web application and wherein the detected input data is an HTTP request.

17. The system according to claim 15 wherein the test is designed to test for a known type of security vulnerability, and wherein the test data includes a malicious payload designed to exploit the security vulnerability.

18. The system according to claim 15 wherein the processor is further configured to initiate an executable operation comprising instru

Assignees

• Saltzman Roi
• Segal Ory
• IBM

Inventors

• Saltzman Roi
• Segal Ory

Classifications

• G06F11/3684 Primary

  for test design, e.g. generating new test cases · CPC title

• G06F11/3636

  by tracing the execution of the program · CPC title

• H04L63/14

  for detecting or protecting against malicious traffic · CPC title

• G06F21/52

  during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} · CPC title

• H04L63/1433 Primary

  Vulnerability analysis · CPC title