Automation Platform for Pentest Collaboration
The present disclosure relates to a system and method of automatically updating change test scenarios based on historical data about the system under test (SUT), its elements, their properties, testing environment, its characteristics and testing steps with their settings using AI. Once the AI has enough historical data, every time a change is made to the SUT, its elements, their properties, or at least one characteristic of the testing environment, the AI system makes a recommendation to update at least one setting of at least one test step in testing scenario.
1 . A method for automatically generating a security test scenario for an element of an information system (IS) using stored historical data about configurations of an element of the IS which have been marked safe and parameters of security test scenarios corresponding to these configurations, comprising:
a. collecting information about different configurations of the element of IS marked as safe in the test management system (TMS) and parameters of security test scenario corresponding to each configuration;
b. generating a N-embedding of the configuration of the element of IS of fixed length N and a M-embedding of the parameters of test scenario of fixed length M;
c. training a neural network NN with input layer of size N and output layer of size M using the N-embedding and M-embedding of collected information, wherein the NN is configured take as an input the N-embedding of the configuration of the element of IS and to output the M-embedding of the parameters of security test scenario of fixed length M;
d. obtaining information about a new configuration of the element of IS;
e. generating an N-embedding of the new configuration of the element of IS;
f. generating an M-embedding by inputting the N-embedding of the new configuration of the element of IS in the neural network NN;
g. generating new parameters of a security testing scenario from the generated M-embedding;
h. applying the new parameters of a security test scenario to the new configuration of the element of IS in the testing management systems (TMS).
2 . The method of claim 1 , wherein the configuration of the element of IS comprises software version, IP address, port number, number of failed login attempts, password strength, amount of available CPU, amount of available memory, available bandwidth, format of incoming parameters, license type, or maintenance schedule.
3 . The method of claim 1 , wherein the training a neural network NN with input layer of size N and output layer of size M using the N-embeddings and M-embedding of collected information, wherein the NN is configured take as an input the N-first embedding of the configuration of the element of IS and to output the M-second embedding of the parameters of test scenario of fixed length N further comprises using N-embeddings and M-embeddings from another test management system.
4 . The method of claim 1 , wherein the applying the new parameters of a security test scenario to the new configuration of the element of IS in the test management system TMS is followed by the step of automatic execution of the new security test scenario.
5 . A method for automatically generating a functional test scenario for an element of an information system (IS) using stored historical data about configurations of an element of the IS which have been marked successfully completed and parameters of functional test scenarios corresponding to these configurations, comprising:
a. collecting information about different configurations of the element of IS marked as successfully completed in the test management system (TMS) and parameters of functional test scenario corresponding to each configuration;
b. generating a N-embedding of the configuration of the element of IS of fixed length N and a M-embedding of the parameters of functional test scenario of fixed length M;
c. training a neural network NN with input layer of size N and output layer of size M using the N-embedding and M-embedding of collected information, wherein the NN is configured take as an input the N-embedding of the configuration of the element of IS and to output the M-embedding of the parameters of test scenario of fixed length M;
d. obtaining information about a new configuration of the element of IS;
e. generating an N-embedding of the new configuration of the element of IS;
f. generating an M-embedding by inputting the N-embedding of the new configuration of the element of IS in the neural network NN;
g. generating new parameters of a functional testing scenario from the generated M-embedding;
h. applying the new parameters of a functional test scenario to the new configuration of the element of IS in the testing management systems (TMS).
6 . The method of claim 5 , wherein the configuration of the element of IS comprises software version, IP address, port number, number of failed login attempts, password strength, amount of available CPU, amount of available memory, available bandwidth, format of incoming parameters, license type, or maintenance schedule.
7 . The method of claim 5 , wherein the training a neural network NN with input layer of size N and output layer of size M using the N-embeddings and M-embedding of collected information, wherein the NN is configured take as an input the N-first embedding of the configuration of the element of IS and to output the M-second embedding of the parameters of test scenario of fixed length N further comprises using N-embeddings and M-embeddings from another test management system.
8 . The method of claim 5 , wherein the applying the new parameters of a functional test scenario to the new configuration of the element of IS in the test management system TMS is followed by the step of automatic execution of the new functional test scenario.
9 . A system for automatically generating a security test scenario for an element of an information system (IS) using stored historical data about configurations of an element of the IS which have been marked safe and parameters of security test scenarios corresponding to these configurations, comprising:
a. an information collector configured to:
i. collect historical data configurations of an element of IS marked as safe in the test management system (TMS) and corresponding parameters of a security test scenario,
ii. pass collected information to the AI learning module;
b. an AI learning module configured to:
i. receive historical data from the information collector,
ii. generate N-embedding from configurations of the element of IS and M-embedding from the corresponding parameters of security test scenario,
iii. train a neural network NN with input layer of size N and output layer of size M using the N-embedding and M-embedding of collected information, wherein the NN is configured take as an input the N-embedding of the configuration of the element of IS and to output the M-embedding of the parameters of security test scenario of fixed length M;
c. an AI recommendation module configured to:
i. obtain information about a new configuration of the element of IS,
ii. generate an N-embedding of the new configuration of the element of IS,
iii. generate an M-embedding by inputting the N-embedding of the new configuration of the element of IS in the neural network NN,
iv. generate new parameters of a security testing scenario from the generated M-embedding;
d. Test management system updater configured to:
i. apply the new parameters of a security test scenario to the new configuration of the element of IS in the testing management systems (TMS).
10 . The system of claim 9 , wherein the configuration of the element of IS comprises software version, IP address, port number, number of failed login attempts, password strength, amount of available CPU, amount of available memory, available bandwidth, format of incoming parameters, license type, or maintenance schedule.
11 . The system of claim 9 , wherein the training a neural network NN with input layer of size N and output layer of size M using the N-embeddings and M-embedding of collected information, wherein the NN is configured take as an input the N-first embedding of the configuration of the element of IS and to output the M-second embedding of the parameters of test scenario of fixed length N further comprises using N-embeddings and M-embeddings from another test management system.
12 . The method of claim 9 , wherein the test management system updater is further configured to follow applying the new parameters of a security test scenario to the new configuration of the element of IS in the test management system TMS by the step of automatic execution of the new security test scenario.