Patent ID: 8925094

Claim:
A method of performing security analysis on a computer program under test (CPUT), the method comprising: via a processor, analyzing the CPUT to identify data pertinent to potential security vulnerabilities of the CPUT; automatically synthesizing at least a first unit test configured to test a particular unit of program code within the CPUT, the first unit test configured to initialize at least one parameter used by the particular unit of program code within the CPUT; providing to the first unit test at least a first test payload configured to exploit at least one potential security vulnerability of the CPUT; dynamically processing the first unit test to communicate the first test payload to the particular unit of program code within the CPUT by communicating to the CPUT an artificial Hypertext Transfer Protocol (HTTP) request comprising the first test payload; determining whether the first test payload exploits an actual security vulnerability of the CPUT; outputting a security analysis report indicating whether the first test payload exploits an actual security vulnerability of the CPUT; receiving from the CPUT a HTTP response to the artificial HTTP request; analyzing the HTTP response to identify additional data pertinent to potential security vulnerabilities of the CPUT; automatically synthesizing at least a second unit test, the second unit test comprising at least a second test payload configured to test the CPUT for at least one potential security vulnerability of the CPUT; and dynamically processing the second unit test to communicate the second test payload to the CPUT.