Static-dynamic integration
Testing software applications often requires a balancing of thoroughness versus the time and computing resources available to perform such tests. By performing a static analysis on candidate software source code and, from the static analysis, configuring a dynamic analysis component to execute the tests, allows for extraneous tests to be omitted. For example, performing certain vulnerability attacks on a function may be futile if the attack requires a string input but the function only accepts integers. By combining static and dynamic analysis, unnecessary tests may be omitted and the results of each analysis process correlated to identify actual vulnerabilities or falsely indicted vulnerabilities reported by one of the static or dynamic analysis component.
1 . A system for training a dynamic analysis component with a configuration generated by a static analysis component, comprising:
at least one processor of a number of processors that accesses instructions maintained in a non-transitory memory that, when executed by the at least one processor of the number of processors, causes the at least one processor of the number of processors to:
access a source code to be evaluated for attack vulnerabilities;
determine a first set of code portions of the source code that are previously determined to be not susceptible to any attack of a set of attacks;
determine a second set of code portions of the source code that are previously determined to be susceptible to at least one attack of the set of attacks;
generate the configuration as a configuration file identifying the second set of code portions and omitting the first set of code portions;
configure at least one of the number of processors to execute an executable form of the source code with the configuration file, wherein execution of the executable form of the source code further comprises executing the at least one attack of the set of attacks in accordance with the configuration file and omitting execution of any attack omitted from the configuration file;
execute the static analysis component and, as portions thereof, perform the accessing of the source code, determine the first set of code portions, determine the second set of code portions, and generate the configuration file; and
execute the dynamic analysis component and, as portions thereof, perform the execution of the executable form of the source code.
2 . The system of claim 1 , wherein the at least one of the number of processors further performs executing the executable form of the source code, comprising executing the at least one attack of the set of attacks.
3 . The system of claim 1 , wherein the at least one of the second set of code portions comprise a Hypertext Transfer Protocol (HTTP) request parameter.
4 . The system of claim 1 , wherein the at least one of the number of processors performs the determination of the first set of code portions of the source code that are previously determined to be not susceptible to any attack of the set of attacks, comprising determining at least one code portion of the first set of code portions, utilizes a data type that is incompatible with each of the set of attacks.
5 . The system of claim 1 , wherein the at least one of the number of processors performs the determination of the first set of code portions of the source code that are previously determined to be not susceptible to any attack of the set of attacks, comprising determining at least one code portion of the first set of code portions is unreachable in the executable form of the source code.
6 . The system of claim 2 , wherein the at least one of the number of processors further performs, as an output to the execution of the executable form of the source code, indicia of vulnerability associated with each of the second set of code portions, each of the at least one attack of the set of attacks, and indicia of success of the at least one attack of the set of attacks.
7 . The system of claim 3 , wherein the HTTP request parameter comprises at least one of a Uniform Resource Locator (URL), a header, a website cookie, HTTP POST data, HTTP GET data, and query data.
8 . The system of claim 5 , wherein the at least one of the number of processors determines the at least one code portion of the first set of code portions is unreachable in the executable form of the source code upon determining the executable form of the source code is associated with a specific platform that causes the at least one code portion of the first set of code portions to be unreachable.
9 . A method for training a dynamic analysis component with a configuration generated by a static analysis component, comprising:
accessing a source code to be evaluated for attack vulnerabilities;
determining a first set of code portions of the source code that are previously determined to be not susceptible to any attack of a set of attacks;
determining a second set of code portions of the source code that are previously determined to be susceptible to at least one attack of the set of attacks;
generating the configuration as a configuration file identifying the second set of code portions and omitting the first set of code portions; and
configuring a processor to execute an executable form of the source code with the configuration file, wherein execution of the executable form of the source code further comprises executing the at least one attack of the set of attacks in accordance with the configuration file and omitting execution of any attack omitted from the configuration file,
wherein the static analysis component performs accessing of the source code, determining the first set of code portions, determining the second set of code portions, and generating the configuration file,
wherein the dynamic analysis component performs the execution of the executable form of the source code;
wherein a first processor accesses instructions maintained in non-transitory memory that when read by the first processor cause the first processor to execute the static analysis component; and
wherein a second processor accesses instructions maintained in non-transitory memory that when read by the second processor cause the second processor to execute the dynamic analysis component.
10 . The method of claim 9 , wherein the processor further performs executing the executable form of the source code, comprising executing the at least one attack of the set of attacks.
11 . The method of claim 9 , wherein the at least one of the second set of code portions comprise a Hypertext Transfer Protocol (HTTP) request parameter.
12 . The method of claim 9 , wherein the first set of code portions of the source code that are previously determined to be not susceptible to any attack of the set of attacks, comprise determining at least one code portion of the first set of code portions, utilizes a data type that is incompatible with each of the set of attacks.
13 . The method of claim 9 , wherein the determination of the first set of code portions of the source code that are previously determined to be not susceptible to any attack of the set of attacks, comprise determining at least one code portion of the first set of code portions is unreachable in the executable form of the source code.
14 . The method of claim 10 , wherein the processor further performs, as an output to the execution of the executable form of the source code, indicia of vulnerability associated with each of the second set of code portions, each of the at least one attack of the set of attacks, and indicia of success of the at least one attack of the set of attacks.
15 . The method of claim 11 , wherein the HTTP request parameter comprises at least one of a Uniform Resource Locator (URL), a header, a website cookie, HTTP POST data, HTTP GET data, and query data.
16 . The method of claim 13 , wherein the at least one code portion of the first set of code portions is unreachable in the executable form of the source code upon determining the executable form of the source code is associated with a specific platform that causes the at least one code portion of the first set of code portions to be unreachable.
17 . A non-transitory computer readable medium comprising instructions that, when read by a processor, cause the processor to perform:
accessing a source code to be evaluated for attack vulnerabilities;
determining a first set of code portions of the source code that are previously determined to be not susceptible to any attack of a set of attacks;
determining a second set of code portions of the source code that are previously determined to be susceptible to at least one attack of the set of attacks;
generating a configuration file identifying the second set of code portions and omitting the first set of code portions;
configuring a processor to execute an executable form of the source code with the configuration file, wherein execution of the executable form of the source code further comprises executing the at least one attack of the set of attacks in accordance with the configuration file and omitting execution of any attack omitted from the configuration file, and
executing a static analysis component and, as portions thereof, performs accessing of the source code, determining the first set of code portions, determining the second set of code portions, and generating the configuration file; and
executing a dynamic analysis component and, as portions thereof, performs the execution of the executable form of the source code.
18 . The non-transitory computer readable medium of claim 17 , wherein the instructions to configure the processor further comprise instructions to cause the processor to execute the at least one attack of the set of attacks and output, as a result of the execution of the executable form of the source code, indicia of vulnerability associated with each of the second set of code portions, each of the at least one attack of the set of attacks, and indicia of success of the at least one attack of the set of attacks.