Efficient and scalable mapping of native mobile applications and of complex rich internet applications for automated security testing

点击翻译按钮获取中文摘要

The ability to "crawl" Web sites and Web applications is at the core of the success of the Web. Crawling is necessary to index, and thus to search. It is also a necessary step to automate tasks such as testing and the assessment of security or usability. With the rise of "Rich Internet Applications" (RIA), where the client side communicates asynchronously with the server, and updates itself partially as needed, there is a tremendous gain in end-user experience. A RIA "feels" like a desktop application. But we have lost our ability to easily crawl Web sites, since it is not anymore simply a matter of following each hyperlink. Another recent evolution in computing is the move to everything mobile. Mobile applications are bound to replace desktop applications in the coming years. It is therefore critical to develop a set of tools adapted to this new paradigm, in particular in the area of security testing. One such tool is the ability to build a model of mobile applications through interaction, that is, the ability to automatically crawl them. This is necessary for automated testing, such as security testing. The first objective of this research is to provide efficient and scalable crawling techniques that work on every RIAs, even the largest ones, and does so entirely automatically. It builds on the results of our previous research, but tackles the open problem that some RIA are simply too large to be crawled exhaustively. The other objective is to adapt this framework to mobile applications. This will enable us to automatically navigate through native mobile applications. Our first focus will be crawling native mobile applications for Android and iPhone.