Patent ID: 8336102

Claim:
A method comprising: receiving, by a fuzzing engine of a computing device, data from a test automation tool, the fuzzing engine and the test automation tool being respective independent computer-program modules, the data being well-formed data for input into an application for testing; changing, by the fuzzing engine, the data to generate malformed data, the changing comprising: parsing the data to generate a tree of groups and elements and corresponding attributes to represent the well-formed data; corrupting at least a subset of the elements in the tree based at least partly on one or more vulnerability patterns; serializing the tree having the corrupted elements to convert the tree into a fuzzed data buffer; attempting to match the parsed data to characteristics in a fuzzing data schema and a current state of the test automation tool; and passing the parsed data to the application when it is determined that there is no match; and when it is determined that there is a match, fuzzing the application with the malformed data to identify any security vulnerabilities in one or more code paths of the application; and providing a notification of any security vulnerability identified responsive to the fuzzing.