Patent ID: 8856935

Claim:
A computer program product for performing security analysis on a computer program under test (CPUT), the computer program product comprising: a computer-readable storage device having computer-readable program code embodied therewith, the computer-readable program code comprising: computer-readable program code configured to analyze the CPUT to identify data pertinent to potential security vulnerabilities of the CPUT; computer-readable program code configured to automatically synthesize at least a first unit test configured to test a particular unit of program code within the CPUT, the first unit test configured to initialize at least one parameter used by the particular unit of program code within the CPUT; computer-readable program code configured to provide to the first unit test at least a first test payload configured to exploit at least one potential security vulnerability of the CPUT; computer-readable program code configured to dynamically process the first unit test to communicate the first test payload to the particular unit of program code within the CPUT including computer-readable program code configured to communicate to the CPUT an artificial Hypertext Transfer Protocol (HTTP) request comprising the first test payload; computer-readable program code configured to determine whether the first test payload exploits an actual security vulnerability of the CPUT; computer-readable program code configured to output a security analysis report indicating whether the first test payload exploits an actual security vulnerability of the CPUT; computer-readable program code configured to receive from the CPUT a HTTP response to the artificial HTTP request; computer-readable program code configured to analyze the HTTP response to identify additional data pertinent to potential security vulnerabilities of the CPUT; computer-readable program code configured to automatically synthesize at least a second unit test, the second unit test comprising at least a second test payload configured to test the CPUT for at least one potential security vulnerability of the CPUT; and computer-readable program code configured to dynamically process the second unit test to communicate the second test payload to the CPUT, wherein the computer-readable storage device is not a transitory, propagating signal per se.