Entit Software LLC

Hewlett Packard Enterprise Development LP

Micro Focus Lcc

Kirill Mendelev

Matias Madou

Sam Ng Ming Sum

Shawn Morgan Simpson

Ronald Joseph Sechman

Philip Edward Hamer

David John Babcock

Lu Zhao

David Scott Tillery

Zeev Messer

Ofer Shezaf

Example embodiments relate to assessing dynamic security scans using runtime analysis and static code analysis. In example embodiments, a system performs static code analysis of a web application to identify reachable code and/or data entry points, where the data entry points are used to determine an attack surface size for the web application. At this stage, the system may initiate runtime monitoring for a dynamic security scan of the web application, where the runtime monitoring detects invocation of a statement at one of the data entry points. The invocation is logged as an invocation entry that comprises invocation parameters and/or code units that were executed in response to the invocation. The system may then determine an attack surface coverage of the dynamic security scan using the invocation entry and the attack surface size and/or a reachable code coverage using the invocation entry and the reachable code.

Determining coverage of dynamic security scans using runtime and static code analyses

Example embodiments disclosed herein relate to actively modify execution at runtime of an application under test (AUT). The AUT is executed using a real-time modifier. A security test is performed on the AUT. Execution of the AUT is modified at a decision point.

Application security testing

Example embodiments disclosed herein relate to analyzing a web application. A web application is loaded. User actions are simulated on user interface elements of the web application. A structure of the web application is traversed based on rules to determine a set of actionable tokens. The respective actionable tokens include a portion of the web application that can change a user interface presented based on the web application.

Analyzing a structure of a web application to produce actionable tokens

Example embodiments disclosed herein relate to present part of a web application with one or more user interface elements of the part highlighted based on updated rules. A web application is loaded in a browser layout engine. User actions are simulated on user interface elements of the web application to update the rules. The part of the web application is presented with one or more user interface elements highlighted.

Presentation of user interface elements based on rules

Example embodiments disclosed herein relate to real-time modification of an application under test (AUT). A security rest is performed on the AUT. A real-time modifier determines that a portion of a function to be executed by the AUT is unsafe. The real-time modifier modifies execution of the AUT to not execute the portion.

In one implementation, a service interface analysis system defines a plurality of service templates based on a plurality of Uniform Resource Identifiers associated with a network service, and generates at least one utility measure of each service template from the plurality of service templates.

Growing community of inventors

Alpharetta, GA, United States of America

Kirill Mendelev