# US 2018/0025154 A1 · Method of Correlating Static and Dynamic Application Security Testing Results for a Web and Mobile Application

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0025154 A1
- Document ID: US20180025154A1
- Status: Published application
- Kind: A1
- Application number: 15/687,186
- Filed: 2017-08-25
- Published: 2018-01-25
- Earliest claimed: 2015-01-30
- Assignees: Denim Group, Ltd.
- Applicants: Denim Group, Ltd.
- Inventors: Dan Cornell; Mac Collins
- Web page: https://patentgrep.com/patent/US20180025154A1

## CPC

- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/563: {by source code analysis}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
- G06F 2221/033: Test or assess software
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

The invention provides a method of correlating and merging static application security testing (SAST) and dynamic application security testing (DAST) for web and mobile applications. The invention provides a method for categorizing and comparing various endpoint objects including the path (i.e., location within the application's attack surface), one or more parameters, an HTTPMethod, a filename on the file system, line number, and mobile entry point.

## Claims

### Claim 1

A method of correlating a static application security testing (SAST) finding and a dynamic application security testing (DAST) finding for an application having a file system with code files containing at least one artifact, which application has an application framework that may be classified as having either a direct framework or an indirect framework, the method comprising:
creating an Endpoint Database using the code files, the Endpoint Database comprising at least one Endpoint Object, each Endpoint Object having at least one of a path property, one or more parameter properties, an HTTPMethod property, a filename property, a line number property, and a mobile entry point;
identifying the application framework using characteristics unique or common to the application framework;
classifying the application framework as direct or indirect;
if the application framework is direct:
extracting each artifact on the file system identified by the SAST result and the DAST result as an extracted artifact;
extracting any nested artifacts from each extracted artifact and placing the nested artifacts into an artifact nesting database;
parsing all HTTP parameters from the extracted artifacts to generate parameter data;
parsing all mobile entry points from the extracted artifacts to generate mobile entry data;
parsing the HTTP method to generate HTTPMethod data;
extracting all path information from each extracted artifact;
determining the Endpoint URLs;
populating an Endpoint Object of the Endpoint Database with the extracted HTTPMethod data, parameter data, Endpoint URLs, and mobile entry data and;
if the application is indirect:
determining the path and filename of each artifact based on the application framework;
identifying entity information and controller information;
retrieving the HTTPMethods and parameters by parsing the control artifacts and entity artifacts;
extracting entity information into entity data;
generating at least one Endpoint Object in the Endpoint Database using the configuration, the controller information, and the entity information.
searching the Endpoint Database for an Endpoint Object associated with SAST or DAST results based on search parameters passed by an Endpoint Query, wherein the search parameters include a SAST finding or a DAST finding;
matching a SAST finding and a DAST finding; and
merging a SAST finding and a DAST findings.

### Claim 2 (depends on 1)

The method of claim 1 wherein the searching step comprises the steps of:
determining if the search parameters include a filename and line number;
if the search parameters include a filename and line number, returning all Endpoint Objects in the Endpoint Database associated with the filename and line number and, if more than one Endpoint Object is returned, searching a data/control flow parameter of the SAST result to locate the Endpoint Object;
if the search parameters do not include a filename and line number, returning a Endpoint Object having the mobile entry point, union of the path, parameter, and HTTPMethod objects of the DAST finding.

### Claim 3 (depends on 2)

The method of claim 2 wherein the matching step comprises:
comparing the vulnerability types of the SAST finding and the DAST finding;
if the vulnerability types are the same, retrieving the file and path locations of the DAST finding from the Endpoint Database;
comparing the retrieved file and path location of the DAST finding to the file and path location of the SAST finding for a match;
if the file and path location of the DAST finding match the file and path location of the SAST finding, updating the Endpoint Object with the SAST finding.

### Claim 4 (depends on 1)

The method of claim 1 wherein the mobile entry point further comprises mobile entry point type, mobile entry point location, and scheme.