Efficient and scalable mapping of native mobile applications and of complex rich internet applications for automated security testing

本机移动应用程序和复杂的富互联网应用程序的高效且可扩展的映射，用于自动化安全测试

• 批准号: 445678-2012
• 负责人: Jourdan, GuyVincent
• 金额: $ 4.95万
• 依托单位: University of Ottawa
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2015
• 资助国家: 加拿大
• 起止时间: 2015-01-01 至 2016-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=575064
• 关键词: Efficient; scalable; mapping; native; mobile

The ability to "crawl" Web sites and Web applications is at the core of the success of the Web. Crawling is necessary to index, and thus to search. It is also a necessary step to automate tasks such as testing and the assessment of security or usability. With the rise of "Rich Internet Applications" (RIA), where the client side communicates asynchronously with the server, and updates itself partially as needed, there is a tremendous gain in end-user experience. A RIA "feels" like a desktop application. But we have lost our ability to easily crawl Web sites, since it is not anymore simply a matter of following each hyperlink. Another recent evolution in computing is the move to everything mobile. Mobile applications are bound to replace desktop applications in the coming years. It is therefore critical to develop a set of tools adapted to this new paradigm, in particular in the area of security testing. One such tool is the ability to build a model of mobile applications through interaction, that is, the ability to automatically crawl them. This is necessary for automated testing, such as security testing. The first objective of this research is to provide efficient and scalable crawling techniques that work on every RIAs, even the largest ones, and does so entirely automatically. It builds on the results of our previous research, but tackles the open problem that some RIA are simply too large to be crawled exhaustively. The other objective is to adapt this framework to mobile applications. This will enable us to automatically navigate through native mobile applications. Our first focus will be crawling native mobile applications for Android and iPhone.

“抓取”网站和Web应用程序的能力是Web成功的核心。爬行是必要的索引，因此搜索。这也是自动化任务（如安全性或可用性的测试和评估）的必要步骤。随着“富互联网应用程序”（RIA）的兴起，客户端与服务器异步通信，并根据需要部分更新自己，最终用户体验有了巨大的提高。RIA“感觉”像一个桌面应用程序。但是我们已经失去了轻松抓取网站的能力，因为这不再是简单地跟踪每个超链接的问题。 计算领域的另一个最新发展是一切都向移动的转移。移动的应用程序在未来几年必将取代桌面应用程序。因此，开发一套适应这一新模式的工具至关重要，特别是在安全测试领域。一个这样的工具是通过交互建立移动的应用程序模型的能力，即自动抓取它们的能力。这对于自动化测试是必要的，例如安全测试。 这项研究的第一个目标是提供有效的和可扩展的爬行技术，工作在每一个RIA，即使是最大的，这样做完全自动。它建立在我们以前的研究成果的基础上，但解决了一些RIA太大而无法彻底抓取的开放问题。另一个目标是使该框架适应移动的应用。这将使我们能够自动浏览本地移动的应用程序。我们的第一个重点将是抓取Android和iPhone的原生移动的应用程序。