Efficient and scalable mapping of native mobile applications and of complex rich internet applications for automated security testing

“爬行”Web站点和Web应用程序的能力是Web成功的核心。爬行是索引所必需的，因此也是搜索所必需的。这也是自动化测试和评估安全性或可用性等任务的必要步骤。随着“富互联网应用程序”(RIA)的兴起，在这种应用程序中，客户端与服务器进行异步通信，并根据需要进行部分更新，从而极大地改善了最终用户体验。RIA“感觉”像是桌面应用程序。但我们已经失去了轻松抓取网站的能力，因为它不再是简单地跟踪每个超链接的问题。 计算的另一个最新发展是向一切移动设备转移。在接下来的几年里，移动应用程序必然会取代桌面应用程序。因此，至关重要的是开发一套适应这一新模式的工具，特别是在安全测试领域。一种这样的工具是通过交互来构建移动应用程序模型的能力，即自动爬行它们的能力。这对于自动化测试(如安全测试)是必要的。 这项研究的第一个目标是提供高效和可扩展的爬行技术，该技术可以在每个RIA上工作，甚至是最大的RIA，并且完全自动执行。它建立在我们之前的研究结果的基础上，但解决了一些RIA太大而无法彻底爬行的公开问题。另一个目标是使这个框架适用于移动应用程序。这将使我们能够在本地移动应用程序中自动导航。我们的第一个重点将是抓取Android和iPhone的原生移动应用程序。

The ability to "crawl" Web sites and Web applications is at the core of the success of the Web. Crawling is necessary to index, and thus to search. It is also a necessary step to automate tasks such as testing and the assessment of security or usability. With the rise of "Rich Internet Applications" (RIA), where the client side communicates asynchronously with the server, and updates itself partially as needed, there is a tremendous gain in end-user experience. A RIA "feels" like a desktop application. But we have lost our ability to easily crawl Web sites, since it is not anymore simply a matter of following each hyperlink. Another recent evolution in computing is the move to everything mobile. Mobile applications are bound to replace desktop applications in the coming years. It is therefore critical to develop a set of tools adapted to this new paradigm, in particular in the area of security testing. One such tool is the ability to build a model of mobile applications through interaction, that is, the ability to automatically crawl them. This is necessary for automated testing, such as security testing. The first objective of this research is to provide efficient and scalable crawling techniques that work on every RIAs, even the largest ones, and does so entirely automatically. It builds on the results of our previous research, but tackles the open problem that some RIA are simply too large to be crawled exhaustively. The other objective is to adapt this framework to mobile applications. This will enable us to automatically navigate through native mobile applications. Our first focus will be crawling native mobile applications for Android and iPhone.