Security Testing Using Semantic Modeling

• US 20150096036A1
• Filed: 06/03/2014
• Published: 04/02/2015
• Est. Priority Date: 09/30/2013
• Status: Active Grant

• Current Assignee: GlobalFoundries, Inc.
• Original Assignee: International Business Machines Corporation
• Inventors: Beskrovny, Evgeny, Landa, Alexander, Tripp, Omer
• Granted Patent: US 9,390,270 B2
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 11/3668 Software testing software testing in telephone exchanges H04M3/242, testing of hardware G06F11/22
• CPC Class Codes: G06F 11/3672 Test management
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Optimized testing of vulnerabilities in an application implemented by a method includes generating a first probe directed to determine whether an application is vulnerable to a first type of attack; analyzing one or more responses from the application based on the application responding to the first probe; in response to determining that the one or more responses from the application validate a first hypothesis about one or more vulnerabilities associated with the application, and generating at least a second probe to further verify the first hypothesis. The second probe focuses on discovering additional details about the application'"'"'s vulnerabilities to the first type of attack or a second type of attack.

Claims

1. A method for optimized testing of vulnerabilities in an application, the method comprising:

generating a first probe directed to determine whether an application is vulnerable to a first type of attack;

analyzing one or more responses from the application based on the application responding to the first probe;

in response to determining that the one or more responses from the application validate a first hypothesis about one or more vulnerabilities associated with the application, generating at least a second probe to further verify the first hypothesis, wherein the second probe focuses on discovering additional details about the application'"'"'s vulnerabilities to the first type of attack or a second type of attack.

2. The method of claim 1, wherein one or more responses from the application based on the application responding to the second probe are analyzed to determine whether the first hypothesis is accurate.

3. The method of claim 1, wherein one or more responses from the application based on the application responding to the second probe are analyzed to determine whether the first hypothesis is accurate, within a first degree of certainty.

4. The method of claim 3, wherein if it is determined that the first hypothesis is accurate with in the first degree of certainty, then it is concluded that the application is vulnerable to at least the first type of attack.

5. The method of claim 1, wherein a test tool is utilized to generate one or more probes targeting the application.

6. The method of claim 5, wherein the application is a web application.

7. The method of claim 3, wherein if it is determined that the first hypothesis is not accurate within the first degree of certainty, further probes for testing the application'"'"'s vulnerabilities to the first type of attack are no longer generated.

8. The method of claim 3, wherein if it is determined that the first hypothesis is not validated, the second probe for testing whether the first hypothesis is valid is not generated.

9. The method of claim 1, wherein the application responds to the first probe based on at least one of a sanitization process or a validation process.

10. The method of claim 1, wherein a probing space for the application is represented as a graph with a plurality of nodes and edges connecting at least two nodes, where a node in the graph represents a hypothesis about a defense mechanism implemented by the application, and an edge connecting two nodes in the graph defines a hierarchical relationship between a first hypothesis and a second hypothesis.

11. A computer program product comprising a computer readable storage medium having a computer readable program, wherein the computer readable program when executed on a computer causes the computer to:

generate a first probe directed to determine whether an application is vulnerable to a first type of attack;

analyze one or more responses from the application based on the application responding to the first probe; and

in response to determining that the one or more responses from the application validate a first hypothesis about one or more vulnerabilities associated with the application, generate at least a second probe to further verify the first hypothesis, wherein the second probe focuses on discovering additional details about the application'"'"'s vulnerabilities to the first type of attack or a second type of attack.

12. The computer program product of claim 11, wherein one or more responses from the application based on the application responding to the second probe are analyzed to determine whether the first hypothesis is accurate.

13. The computer program product of claim 11, wherein one or more responses from the application based on the application responding to the second probe are analyzed to determine whether the first hypothesis is accurate, within a first degree of certainty.

14. The computer program product of claim 11, wherein if it is determined that the first hypothesis is accurate with in the first degree of certainty, then it is concluded that the application is vulnerable to at least the first type of attack.

15. The computer program product of claim 11, wherein a test tool is utilized to generate one or more probes targeting the application.