Progressive black-box testing of computer software applications

• US 9,195,570 B2
• Filed: 09/27/2013
• Issued: 11/24/2015
• Est. Priority Date: 09/27/2013
• Status: Active Grant

• Current Assignee: HCL Technologies Limited
• Original Assignee: International Business Machines Corporation
• Inventors: Tripp, Omer
• Primary Examiner(s): COYER, RYAN D
• Application Number:
  US14/040,302
• Publication Number:
  US 20150095886A1
• Time in Patent Office: 788 Days
• Field of Search: 717/128, 726/25
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3672 Test management
• CPC Class Codes: G06F 21/566 Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 8/71 Version control security arrangements therefor G06F21/57; Configuration management

Abstract

Testing computer software applications by performing a first black-box test on a computer software application, identifying any instructions of the computer software application that were reached by a payload of the first black-box test, determining a degree of success of the first black-box test in accordance with predefined success criteria, determining whether any of the instructions that were reached by the payload changed after performing the first black-box test, deciding whether to perform a second black-box test on the computer software application, where the deciding whether to perform the second black-box test is based on whether any of the instructions that were reached by the payload of the first black-box test changed after performing the first black-box test, and the degree of success of the first black-box test.

Claims

1. A system for testing computer software applications, the system comprising:

a processor; and

a memory including instructions, which, when executed on the processor, perform an operation, comprising;

a black-box tester configured to perform a first black-box test on a computer software application,

a test monitor configured to;

identify any instructions of the computer software application that were reached based on a payload of the first black-box test, and

determine a degree of success of the first black-box test in accordance with predefined success criteria,

a code monitor configured to;

monitor coding tools used to modify the instructions of the computer software application,

monitor the instructions of the computer software application for changes after black-box tests are performed on the computer software application,

determine, based on the monitored coding tools and the monitored instructions, whether any of the instructions that were reached by the payload changed after performing the first black-box test, and

a test controller configured to decide whether to perform a second black-box test on the computer software application, wherein the test controller is configured to decide whether to perform the second black-box test based on;

whether any of the instructions that were reached by the payload of the first black-box test changed after performing the first black-box test, and

the degree of success of the first black-box test.

2. The system according to claim 1 wherein the test controller is configured to decide whether to perform the second black-box test based on whether a detected change to any of the instructions that were reached by the payload relates to a security vulnerability.

3. The system according to claim 1 wherein the test controller is configured to configure the second black-box test to be identical to the first black-box test.

4. The system according to claim 3 wherein the test controller is configured to decide to perform the second black-box test responsive to determining that the first black-box test failed and that any of the instructions that were reached by the payload of the first black-box test changed after performing the first black-box test.

5. The system according to claim 1 wherein the test controller is configured to configure the second black-box test to include a variant of the payload used in the first black-box test, wherein both the first black-box test and the second black-box test are configured to test for the same type of behavior.

6. The system according to claim 5 wherein the test controller is configured to decide to perform the second black-box test responsive to determining that the first black-box test failed and that the instructions that were reached by the payload of the first black-box test are unchanged after performing the first black-box test.

7. The system according to claim 5 wherein the test controller is configured to decide to perform the second black-box test responsive to determining that the first black-box test succeeded and that the instructions that were reached by the payload of the first black-box test are unchanged after performing the first black-box test.

8. The system according to claim 5 wherein the test controller is configured to decide to perform the second black-box test responsive to determining that the first black-box test succeeded and that any of the instructions that were reached by the payload of the first black-box test changed after performing the first black-box test.

9. The system according to claim 1 wherein the code monitor is configured to determine whether the instructions that were reached by the payload of the first black-box test participate in a security-relevant flow, and

wherein the test controller is configured to decide to perform the second black-box test only if the instructions that were reached by the payload of the first black-box test participate in a security-relevant flow.

10. A computer program product for testing a computer software application, the computer program product comprising:

a non-transitory, computer-readable storage medium; and

computer-readable program code embodied in the computer-readable storage medium, wherein the computer-readable program code is configured to;

perform, via a black-box tester, a first black-box test on a computer software application,

identify any instructions of the computer software application that were reached based on a payload of the first black-box test,

determine a degree of success of the first black-box test in accordance with predefined success criteria,

monitor coding tools used to modify the instructions of the computer software application,

monitor the instructions of the computer software application for changes after black-box tests are performed on the computer software application,

determine, based on the monitored coding tools and the monitored instructions, whether any of the instructions that were reached by the payload changed after performing the first black-box test, and

decide whether to perform a second black-box test on the computer software application, wherein the test controller is configured to decide whether to perform the second black-box test based on

whether any of the instructions that were reached by the payload of the first black-box test changed after performing the first black-box test, and

the degree of success of the first black-box test.