DETERMINING COVERAGE OF DYNAMIC SECURITY SCANS USING RUNTIME AND STATIC CODE ANALYSES

摘要

Example embodiments relate to assessing dynamic security scans using runtime analysis and static code analysis. In example embodiments, a system performs static code analysis of a web application to identify reachable code and/or data entry points, where the data entry points are used to determine an attack surface size for the web application. At this stage, the system may initiate runtime monitoring for a dynamic security scan of the web application, where the runtime monitoring detects invocation of a statement at one of the data entry points. The invocation is logged as an invocation entry that comprises invocation parameters and/or code units that were executed in response to the invocation. The system may then determine an attack surface coverage of the dynamic security scan using the invocation entry and the attack surface size and/or a reachable code coverage using the invocation entry and the reachable code.

主权项

1. A system for assessing dynamic security scans using runtime analysis and static code analysis, the system comprising:
a processor to:
perform the static code analysis of a web application to identify a plurality of data entry points for the web application, wherein the plurality of data entry points are used to determine an attack surface size for the web application;initiate runtime monitoring for a dynamic security scan of the web application;detect, by the runtime monitoring, invocation of a statement at one of the plurality of data entry points, wherein the invocation is logged as an invocation entry that comprises invocation parameters and a timestamp; anddetermine an attack surface coverage of the dynamic security scan using the invocation entry and the attack surface size.