Testing application internal modules with instrumentation

Patent metadata

Field	Value
Publication number	US-9703676-B2
Application number	US-201414587834-A
Country	US
Kind code	B2
Filing date	Dec 31, 2014
Priority date	Dec 31, 2014
Publication date	Jul 11, 2017
Grant date	Jul 11, 2017

Abstract

Testing internal modules of application code includes applying, via a computer processor, instrumentation hooks to internal module interface points and external module interface points of the application code, executing the application code and recording values received at the instrumented interface points, determining an accessible internal module input point and a constraint based on the recorded values from the instrumented external module interface points, and testing the accessible internal module input point based on the constraint.

First claim

What is claimed is:

1. A system, comprising:
a memory having computer readable instructions; and
a processor executing the computer readable instructions, the computer readable instructions including:
receiving application code and instrumenting the application code by inserting instrumentation hooks at internal module input points, external module input points and external module release points of the application code, wherein the instrumentation hooks are value loggers configured to:
insert a value logger into a module at a point of execution of the module, wherein inserting the value logger instruments release points and input points of both of the input modules and the output modules;

mapping data flow between the external module release points and the internal module input points of the application code via the instrumentation hooks;
determining at least one of the internal module input points is accessible via at least one of the external module release points;
determining a constraint by calculating the difference between the recorded values at the external module release point and external module input point of the respective external module;
and
testing the accessible internal module input point associated with the respective external module release point by sending a test value based on the constraint associated with the external module release point to the accessible internal module input point, wherein testing comprises sending test values that test for a data leakage, the test values based on a plurality of constraints from a plurality of external modules.

2. The system of claim 1 , wherein the internal module input points and the external module release points comprise inter-process communication (IPC) points.

3. The system of claim 1 , wherein the instrumentation hooks comprise a plurality of value loggers.

4. The system of claim 1 , wherein the computer readable instructions include dynamically analyzing the application code by mapping the data flow after executing the instrumented application code and recording values at the instrumentation hooks.

5. The system of claim 1 , wherein the computer readable instructions include determining whether an internal module input point is accessible via the external module release points by matching a value recorded by the instrumentation hook at the internal module input point and a value recorded by the instrumentation hook at an associated external module release point.

6. The system of claim 1 , the computer readable instructions include identifying a vulnerable internal module input point based on the test.

7. A method, comprising:
applying, via a processor, instrumentation hooks to internal module interface points and external module interface points of application code, said external module interface points including an external module release point and an external module input point, wherein the instrumentation hooks are value loggers configured to:
insert a value logger into a module at a point of execution of the module, wherein inserting the value logger instruments release points and input points of both of the input modules and the output modules;

executing, via the processor, the application code and recording values received at the instrumented interface points;
determining, via the processor, at least one of the internal module input points is accessible via at least one of the external module release points and determining a constraint associated with an external module interface point by calculating the difference between the recorded values at the external module release point and external module input point of a respective external module; and
testing, via the processor, the accessible internal module input point associated with the external module interface point based on the constraint associated with the external module interface point, wherein testing comprises sending test values that test for a data leakage, the test values based on a plurality of constraints from a plurality of external modules.

8. The method of claim 7 , wherein the application code is analyzed dynamically.

9. The method of claim 7 , wherein applying the instrumentation hooks to internal module interface points and external module interface points is performed during analysis of the application code.

10. The method of claim 9 , wherein the analysis and applying of instrumentation hooks to the application code is automated by inserting the instrumentation hooks into the application code after receiving the application code.

11. The method of claim 7 , further comprising identifying, via the processor, a vulnerable internal input point of the application code.

12. The method of claim 7 , wherein applying instrumentation hooks to the internal module interface points comprises inserting value loggers at the internal module input points.

13. The method of claim 7 , wherein applying instrumentation hooks to the external module interface points comprises applying instrumentation hooks at external module input points and external module release points.

14. A computer program product for testing an application, the computer program product comprising a computer-readable storage medium having program code embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program code executable by a processor to cause the processor to:
apply instrumentation hooks to an application code at internal module input points, external module input points, and external module release points, wherein the instrumentation hooks are value loggers configured to:
insert a value logger into a module at a point of execution of the module, wherein inserting the value logger instruments release points and input points of both of the input modules and the output modules;

execute the application and record values received at the instrumented points;
determine an accessible internal module input point;
determine a constraint by calculating the difference between the recorded values at the external module release point and external module input point of a respective external module; and
test the accessible internal module input point associated with the respective external module release point by sending a test value based on the constraint associated with the external module release point to the accessible internal module input point, wherein testing comprises sending test values that test for a data leakage, the test values based on a plurality of constraints from a plurality of external modules.

15. The computer program product of claim 14 , further comprising program code executable by the processor to cause the processor to automatically instrument the application code by inserting instrumentation hooks into the application code.

16. The computer program product of claim 14 , further comprising program code executable by the processor to cause the processor to map an external module release point to an internal module input point.

17. The computer program product of claim 14 , further comprising program code executable by the processor to cause the processor to test the accessible internal input point by sending the accessible internal input point a value based on the constraint.

18. The computer program product of claim 17 , further comprising program code executable by the processor to cause the processor to identify a vulnerable internal entry point of business logic.

Assignees

• IBM

Inventors

• Hay Roee
• Tripp Omer

Classifications

• G06F11/3644 Primary

  by instrumenting at runtime · CPC title