Patent ID: 9398041
Filing Date: 2016-07-19
CPC Classification: G06F,H04L

Claim Text:
1. A method for identifying stored vulnerabilities in a web service, the method comprising the steps of: identifying each web method, of a web service, declared in a web services description language (WSDL) file; adding a node within a directed graph for each web method identified; identifying pairs of web methods declared in the WSDL file in which a match exists between an output parameter of one of the web methods within one of the pairs identified, and an input parameter of another one of the web methods within the one of the pairs identified; adding an edge within the directed graph for each of the pairs of web methods identified; generating one or more sequences of web methods based on nodes connected by edges within the directed graph, wherein each of the one or more sequences of web methods includes at least one of the pairs of web methods identified, wherein the step of generating one or more sequences of web methods based on the directed graph comprises utilizing a breadth-first search to traverse each edge within the directed graph, and to access the nodes connected by one or more of the edges within the directed graph in order to identify a match between at least an output parameter of one of the web methods within the one of the pairs identified and an input parameter of another web method within the one of the pairs identified; responsive to determining that an amount of the generated one or more sequences of web methods exceeds a threshold, applying a heuristic to the directed graph to obtain a reduced amount of the generated one or more sequences of web methods for subsequent testing; and executing, by one or more processors, a vulnerabilities detection program to test each of the reduced amount of the generated one or more sequences of web methods to identify stored vulnerabilities in the web service.