Targeted security testing
AssigneeInternational Business Machines Corporation
InventorsYair Amit, Lotem Guy, Daniel Kalman, Ori Segal, Omri Weisman
Life of this patent
Estimating the term…
Abstract
Source code of a plurality of web pages including script code is statically analyzed. A page including a potential vulnerability is identified based on the static analysis. A page not including a potential vulnerability is identified based on the static analysis. The web page including the potential vulnerability is dynamically analyzed using a set of test payloads. The page not including the potential vulnerability is dynamically analyzed using a subset of the set of test payloads, the subset including fewer test payloads than the set of test payloads.
Claims8
A computer implemented method comprising:
- statically analyzing, on a computing device, source code of a plurality of web pages including script code;
- identifying, on the computing device, a web page including a potential vulnerability based on the static analysis;
- identifying, on the computing device, a web page not including a potential vulnerability based on the static analysis;
- dynamically analyzing, on the computing device, the web page including the potential vulnerability using a set of test payloads;
- and
- dynamically analyzing, on the computing device, the web page not including the potential vulnerability using a subset of the set of test payloads, the subset including fewer test payloads than the set of test payloads.
8-21. (canceled)
Dependencies are inferred from the claim text.