Comparing Effectiveness and Efficiency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System

Oct 14, 2026

Security resources are limited, so practitioners need actionable guidance on selecting cybersecurity techniques and tools to detect and prevent software vulnerability exploitation. This research evaluates Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) and compares their effectiveness and efficiency against established approaches including Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST). Using OpenMRS as a large Java-based system, the study measures vulnerabilities detected and prevented per hour, yielding results that support informed tool selection.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages31

Reading Time11 min

AccessFree to download

Abstract

Objective

Methods

Results

Conclusion

Keywords

Introduction

arXiv :2312 . 17726v1 [ cs .CR] 29 Dec 2023 Noname manuscript No.(will be inserted by the editor) Comparing E􀀋ectiveness and E􀀎ciency of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) Tools in a Large Java-based System Aishwarya Seth 􀀁 Saikath Bhattacharya 􀀁 Sarah Elder 􀀁 Nusrat Zahan 􀀁 Laurie Williams the date of receipt and acceptance should be inserted later Abstract CONTEXT: Security resources are scarce, and practitioners need guidance in the e􀀋ective and e􀀎cient usage of techniques and tools available in the cybersecurity industry for detecting and preventing the exploitation of vulnerabilities in software, as per the practitioners’ requirements. Two emerging tool types, Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP), have not been thoroughly evaluated against well-established counterparts such as Dynamic Application Security Testing (DAST) and Static Application Security Testing (SAST) . OBJECTIVE: The goal of this research is to aid practitioners in making informed choices about the use of Interactive Application Security Testing (IAST) and Runtime Application Self-Protection (RASP) tools through an analysis of their e􀀋ectiveness and e􀀎ciency in comparison with di􀀋erent vulnerability detection and prevention techniques and tools. A. Seth North Carolina State University E-mail: [aseth@ncsu.edu](aseth@ncsu.edu) [S. Bhattacharya](S. Bhattacharya) Milwaukee School of Engineering E-mail: [bhattacharya@msoe.edu](bhattacharya@msoe.edu) S. Elder North Carolina State University E-mail: [seelder@ncsu.edu](seelder@ncsu.edu) N. Zahan North Carolina State University E-mail: [nzahan@ncsu.edu](nzahan@ncsu.edu) L. Williams North Carolina State University E-mail: laurie [williams@ncsu.edu](williams@ncsu.edu) 2 Aishwarya Seth et al. METHODS: We apply IAST and RASP on OpenMRS, an open-source Javabased online application. We compare the e􀀎ciency and e􀀋ectiveness of IASTand RASP with techniques applied on OpenMRS in prior work: Systematic (SMPT) and Exploratory (EMPT) Manual Penetration Testing techniques, as well as SAST and DAST tools. We measure e􀀎ciency and e􀀋ectiveness in terms of the number and type of vulnerabilities detected and prevented per hour. RESULTS: Our study shows IAST performed relatively well compared to other techniques, performing second-best in both e􀀎ciency and e􀀋ectiveness. IAST detected eight Top-10 OWASP security risks compared to nine by SMPT and seven for EMPT, DAST, and SAST. IAST found more vulnerabilities than SMPT. The e􀀎ciency of IAST (2.14 VpH) is second to only EMPT (2.22 VpH) . These 􀀌ndings imply that our study bene􀀌ted from using IAST when conducting black-box security testing. We also found RASP only prevents Injection attacks in OpenMRS. CONCLUSION: In the context of a large, enterprise-scale web application such as OpenMRS, RASP does not replace vulnerability detection, while IAST is a powerful tool that complements other techniques. Keywords Vulnerability Management 􀀁 Web Application Security 􀀁 Security Analysis Tools 􀀁 Vulnerability Scanners, 􀀁 Interactive Application Security Testing 􀀁 Runtime Application Self-Protection 1 Introduction To build secure software while addressing the ever-growing attack surface, practitioners must utilize the available resources as e􀀎ciently as possible to remove the most vulnerabilities from software. Practitioners often use di􀀋erent technologies that optimize resources and increase e􀀎ciency to improve vulnerability detection e􀀋orts while not expanding the resources. Therefore, practitioners can bene􀀌t from guidance in selecting vulnerability detection and prevention techniques and tools. Prior work comparing vulnerability detection techniques, such as the series of studies by Elder et al. and Austin et al. [1,2,3], does not take into account the performance of two emerging tool types, Interactive Application Security Testi

FAQs

What is the objective of this research?

To help practitioners choose between IAST and RASP by analyzing their effectiveness and efficiency compared with other vulnerability detection and prevention techniques and tools.

How are IAST and RASP evaluated in the study?

They are applied to OpenMRS, and their efficiency and effectiveness are compared with prior work using manual penetration testing techniques plus SAST and DAST tools.

What are the key findings about IAST and RASP?

IAST performs relatively well, ranking second in both efficiency and effectiveness, and it detects more vulnerabilities than SMPT; RASP, in this context, only prevents Injection attacks and does not replace detection.

Oct 14, 2026

Upload by kopisore