Reproduce “Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Aishwarya Seth, Saikath Bhattacharya, Sarah Elder, Nusrat Zahan, Laurie Williams
Researchers from North Carolina State University empirically evaluated Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools on OpenMRS, a large Java-based system. Their analysis showed IAST to be an effective and efficient vulnerability detection technique, finding 91 unique vulnerabilities and achieving a 2.14 vulnerabilities per hour efficiency, while RASP was effective specifically against 44 injection vulnerabilities.
Key insights
- IAST tools serve as a valuable complement to existing security testing methods, detecting a significant number of unique vulnerabilities (52) not found by SAST, DAST, or manual penetration testing.
- RASP effectively prevents specific types of attacks (injection) at runtime, demonstrating its role as a specialized prevention layer rather than a comprehensive detection or broad protection solution.
- A multi-tool, multi-technique approach remains essential for comprehensive application security, as no single tool or method provides complete vulnerability coverage or prevention.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.