Evaluation of software applications
View Patent ↗Software applications receive input data, perform processing of the received data and generate output. In one aspect the output is modification of data structures. The software application is tested with instances of input data that lead to various data modifications in the data structures. In another aspect, patterns are found in the modifications of the data structures, which are evaluated and analyzed for software vulnerabilities.
1. A computer implemented method for evaluation of a software application comprising:
simulating input data for the software application;
generating data structures from the input data based on application logic of the software application, wherein evaluation snapshots for the software application are derived for the generated data structures;
determining patterns of the generated data structures in the evaluation snapshots, the patterns indicating dependencies between the generated data structures and the input data, wherein determining the patterns further comprises:
determining a graph including a set of the evaluation snapshots that do not coincide with one another;
receiving a software application evaluation snapshot;
executing a program step of the software application;
collecting a resulting evaluation snapshot from the execution of the program step;
mapping the resulting evaluation snapshot to an existing snapshot from the set of the evaluation snapshots to determine whether an execution breakpoint, changed variable, and input patterns of the input data related to the resulting evaluation snapshot coincide with an execution breakpoint, changed variable, and input patterns of input data related to the existing snapshot from the set of the evaluation snapshots; and
adding the resulting evaluation snapshot to the set of the evaluation snapshots when the resulting evaluation snapshot does not coincide with the existing snapshot from the set of evaluation snapshots; and
evaluating the patterns based on predefined rules.
2. The method of claim 1 , further comprising reporting critical instances of the input data based on the evaluation of the patterns.
3. The method of claim 1 , wherein determining the patterns of the generated data structures further comprises excluding the resulting evaluation snapshot from the set of the evaluation snapshots when the resulting evaluation snapshot comprises predefined exclusive patterns.
4. The method of claim 1 , wherein evaluating the patterns based on the predefined rules comprises:
checking the patterns for critical scenarios for the software application; and
defining critical instances of the input data for the critical scenarios.
5. The method of claim 4 , wherein checking the patterns for the critical scenarios comprises:
checking for system crashes; and
checking for security faults.
6. A computer system for evaluation of a software application comprising:
a processor; and
a memory in communication with the processor, the memory storing instructions related to:
an in-flow data engine to simulate input data for the software application, the input data generating data structures in the memory based on application logic of the software application, wherein evaluation snapshots for the software application are derived for the generated data structures; and
an evaluation engine to:
determine patterns of the generated data structures in the evaluation snapshots, the patterns indicating dependencies between the data structures and the input data, wherein determining the patterns further comprises:
determining a graph including a set of the evaluation snapshots that do not coincide with one another;
receiving a software application evaluation snapshot;
executing a program step of the software application;
collecting a resulting evaluation snapshot from the execution of the program step;
mapping the resulting evaluation snapshot to an existing snapshot from the set of the evaluation snapshots to determine whether an execution breakpoint, changed variable, and input patterns of the input data related to the resulting evaluation snapshot coincide with an execution breakpoint, changed variable, and input patterns of input data related to the existing snapshot from the set of the evaluation snapshots;
adding the resulting evaluation snapshot to the set of the evaluation snapshots when the resulting evaluation snapshot does not coincide with the existing snapshot from the set of evaluation snapshots; and
evaluate the patterns based on predefined rules.
7. The system of claim 6 , wherein the evaluation engine is further operable to:
report critical instances of the input data based on the evaluation of the patterns.
8. The system of claim 6 , wherein the evaluation engine is operable to exclude the resulting evaluation snapshot from the set of the evaluation snapshots when the resulting evaluation snapshot comprises predefined exclusive patterns.
9. The system of claim 6 , wherein the evaluation engine is further operable to:
check the patterns for critical scenarios for the software application; and
define the critical instances of the input data for the critical scenarios.
10. The system of claim 9 , wherein the evaluation engine is further operable to:
check for system crashes; and
check for security faults.
11. An article of manufacture including a non-transitory computer readable storage medium to tangibly store instructions, which when executed by a computer, cause the computer to:
simulate input data for the software application;
generate data structures from the input data based on application logic of the software application, wherein evaluation snapshots for the software application are derived for the generated data structures;
determine patterns of the generated data structures in the evaluation snapshots, the patterns indicating dependencies between the data structures and the input data, wherein determining the patterns further comprises:
determining a graph including a set of the evaluation snapshots that do not coincide with one another;
receiving a software application evaluation snapshot;
executing a program step of the software application;
collecting a resulting evaluation snapshot from the execution of the program step;
mapping the resulting evaluation snapshot to an existing snapshot from the set of the evaluation snapshots to determine whether an execution breakpoint, changed variable, and input patterns of the input data related to the resulting evaluation snapshot coincide with an execution breakpoint, changed variable, and input patterns of input data related to the existing snapshot from the set of the evaluation snapshots; and
adding the resulting evaluation snapshot to the set of the evaluation snapshots when the resulting evaluation snapshot does not coincide with the existing snapshot from the set of evaluation snapshots; and
evaluate the patterns based on predefined rules.
12. The article of manufacture of claim 11 , further storing instructions, which when executed by a computer, cause the computer to report critical instances of the input data based on the evaluation of the patterns.
13. The article of manufacture of claim 11 , wherein the instructions to determine the patterns of the generated data structures further comprise instructions, which when executed by a computer, cause the computer to exclude the resulting evaluation snapshot from the set of the evaluation snapshots when the resulting evaluation snapshot comprises predefined exclusive patterns.
14. The article of manufacture of claim 11 , wherein the instructions to evaluate the patterns based on the predefined rules further comprise instructions, which when executed by a computer, cause the computer to:
check the patterns for critical scenarios for the software application; and
define critical instances of the input data for the critical scenarios.
15. The article of manufacture of claim 14 , wherein the instructions to check the patterns for the critical scenarios further comprise instructions, which when executed by a computer, cause the computer to:
check for system crashes; and
check for security faults.