# US 9,438,617 B2 · Application security testing

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,438,617 B2
- Document ID: US9438617B2
- Status: Granted
- Kind: B2
- Application number: 14/431,996
- Filed: 2012-09-28
- Published: 2015-09-17
- Granted: 2016-09-06
- Earliest claimed: 2012-09-28
- Assignees: Hewlett Packard Enterprise Development LP
- Applicants: Hewlett-Packard Development Company, L.P.
- Inventors: Kirill Mendelev; Matias Madou; Sam Ng Ming Sum
- Web page: https://patentgrep.com/patent/US9438617B2

## CPC

- H04L 63/1433: {Vulnerability analysis}
- G06F 11/3672: {Test management}
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Example embodiments disclosed herein relate to real-time modification of an application under test (AUT). A security rest is performed on the AUT. A real-time modifier determines that a portion of a function to be executed by the AUT is unsafe. The real-time modifier modifies execution of the AUT to not execute the portion.

## Claims

### Claim 1

A computing system comprising:
a hardware server coupled to a computing device, the hardware server to host an application under test in a testing environment, wherein the hardware server includes instructions executable by the hardware server to:
determine that a function to be executed by the application under test includes a vulnerability and prevent a portion of the function that includes the vulnerability from being executed;
identify instructions associated with an application programming interface (API) called by the application under test that include the vulnerability; and
modify the execution of the application under test by substituting the identified instructions with instructions associated with a different API.

### Claim 2 (depends on 1)

The computing system of claim 1, wherein the hardware server includes instructions executable by the hardware server to:
recognize whether the function includes the vulnerability.

### Claim 3 (depends on 1)

The computing system of claim 1, wherein the instructions to determine that the function includes the vulnerability include instructions to determine that the function includes the vulnerability based on a type of process to be performed by the portion of the function.

### Claim 4 (depends on 3)

The computing system of claim 3, wherein the type of process is at least one of the following:
a process to delete a database record;
a process to modify another database record;
a process to pollute a database;
a process to send an outgoing message; and
a process to exhaust resources of the hardware server.

### Claim 5 (depends on 1)

The computing system of claim 1, wherein the instructions to determine that the function includes the vulnerability include instructions to:
determine that the function includes the vulnerability based on an application programming interface called by the function.

### Claim 6 (depends on 1)

The computing system of claim 1, wherein the hardware server includes instructions executable by the hardware server to:
emulate the function without performing the portion of the function that includes the vulnerability.

### Claim 7 (depends on 1)

The computing system of claim 1, wherein the instructions to prevent the portion of the function that includes the vulnerability from being executed include instructions to block the portion from being executed.

### Claim 8 (depends on 1)

The computing system of claim 1, further including instructions executable by the hardware server to:
report the vulnerability associated with the portion to a penetration test executed by the computing device.

### Claim 9

A non-transitory machine-readable storage medium storing instructions that, if executed by a hardware processor of a device, cause the device to:
receive communications from a computing device communicatively coupled to an application under test hosted using a real-time modifier to perform a security test on the application under test;
determine, by the real-time modifier, that a portion of a function to be executed by the application under test includes a vulnerability;
modify, by the real-time modifier, an execution of the application under test to prevent execution of the portion;
identify, by the real-time modifier, instructions associated with an application programming interface (API) called by the application under test that include the vulnerability; and
modify the execution of the application under test by substituting, by the real-time modifier, the identified instructions with instructions associated with a different API.

### Claim 10 (depends on 9)

The non-transitory machine-readable storage medium of claim 9, further comprising instructions that, if executed by the hardware processor, cause the device to:
determine that the portion includes the vulnerability based on a type of a process associated with the portion,
wherein the type of the process performs at least one of the following:
delete a database record, modify another database record, pollute a database, send an outgoing message, and exhaust resources of the device.

### Claim 11 (depends on 9)

The non-transitory machine-readable storage medium of claim 9, further comprising instructions that, if executed by the hardware processor, cause the device to:
determine that the portion includes the vulnerability based on an application programming interface called by the function,
wherein the real-time modifier emulates the function without performing the portion of the function that includes the vulnerability.

### Claim 12 (depends on 9)

The non-transitory machine-readable storage medium of claim 9, further comprising instructions that, if executed by the at least one processor, cause the device to:
report the vulnerability associated with the portion to the security test,
wherein the security test is a penetration test.

### Claim 13

A method comprising:
hosting an application under test using a real-time modifier on a server;
receiving communications from a computing device communicatively coupled to the application under test to perform a security test on the application under test;
determining, by the real-time modifier, that a portion of a function to be executed by the application under test includes a vulnerability based on a type of activity caused by the portion;
modifying, by the real-time modifier, an execution of the application under test to prevent execution of the portion;
identifying instructions associated with an application programming interface (API) called by the application under test that include the vulnerability; and
modifying the execution of the application under test by substituting the identified instructions with instructions associated with a different API.

### Claim 14 (depends on 13)

The method of claim 13, further comprising:
emulating a functionality of the portion to provide a response to the security test.

### Claim 15 (depends on 14)

The method of claim 14, further comprising:
reporting the vulnerability caused by the portion to the security test.

### Claim 16 (depends on 1)

The system of claim 1, further including instructions executable by the hardware server to modify behavior of the application under test in response to the determined vulnerability.

### Claim 17 (depends on 16)

The system of claim 16, wherein the behavior is modified in an application associated with the application under test, during runtime of the application.

### Claim 18 (depends on 1)

The system of claim 1, further including instructions executable by the hardware server to monitor a plurality of application programming interfaces (APIs) called by the application under test.

### Claim 19 (depends on 1)

The system of claim 1, wherein the instructions to prevent the portion of the function from being executed include instructions executable by the hardware server to prevent a portion of instructions associated with the vulnerability from being called.