Testing for software vulnerability using environment perturbation

Proceedings of the 2002 International Conference on Dependable Systems and Networks

Volumn , Issue , 2000, Pages 603-612

  Du, Wenliang ^a   Mathur, Aditya P ^b  

^a PURDUE UNIVERSITY   (United States)

^b Purdue University   (United States)

Author keywords

Environment perturbation; Fault injection; Security flaws; Security testing

Indexed keywords

COMPUTER OPERATING SYSTEMS; COMPUTER SIMULATION; COMPUTER SOFTWARE SELECTION AND EVALUATION; FAILURE ANALYSIS; PERTURBATION TECHNIQUES; SECURITY OF DATA;

ENVIRONMENT APPLICATION INTERACTION MODEL; ENVIRONMENT PERTURBATION; FAULT INJECTION; SECURITY FLAWS; SECURITY TESTING; SOFTWARE TESTING;

FAULT TOLERANT COMPUTER SYSTEMS;

EID: 0034590639     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (29)

1. T. Aslam. A taxonomy of security faults in the unix operation system. Master's thesis, Purdue University, August 1995.
2. B. Beizer. Software Testing Techniques. Van Nostrand Reinhold, New York, 1990.
3. M. Bishop. A taxonomy of unix system and network vulnerabilities. Technical Report CSE-95-10, Department of Computer Science, University of California at Davis, May 1995.
4. M. Bishop and M. Dilger. Checking for race conditions in file accesses. The USENIX Association Computing Systems, 9(2):131-151, Spring 1996.
5. J. Clark and D. Pradhan. Fault injection: A method for validating computer-system dependability. IEEE Computer, pages 47-56, June 1995.
6. W. Du and A. Mathur. Categorization of software errors that led to security breaches. In 21st National Information Systems Security Conference, Crystal City, VA, 1998.
7. W. Du and A. Mathur. Security relevancy analysis on the registry of windows nt 4.0. In ACSAC'99 15th Annual Computer Security Applications Conference, Phoenix, Arizona, December 6-10 1999.
8. G. Fink and K. Levitt. Property-based testing of privileged programs. In Proceedings of the 10th Annual Computer Security Applications Conference; Orlando, FL, USA; 1994 Dec 5-9, 1994.
9. B. Miller, L. Fredriksen and B. So. An empirical study of the reliability of unix utilities. Communications of the ACM, 33(12):32-44, December 1990.
10. S. Garfinkel and G. Spafford. Practical UNIX & Internet Security. O'Reilly & Associates, Inc., 1996.
11. J. Goodenough and S. Gerhart. Toward a theory of testing: Data selection criteria. current Trends in Programming Methodology, 2:44-79, 1977.
12. H. Zhu, P. Hall and J. May. Software unit test coverage and adequacy. ACM Computing Surveys, 29(4):366-427, December 1997.
13. W. Kao, R. Iyer and D. Tang. FINE: A fault injection and monitoring environment for tracing the unix system behavior under faults. IEEE Transactions on Software Engineering, 19(11):1105-1118, November 1993.
14. S. Dawson, F. Jahanian and T. Mitton. ORCHESTRA: A fault injection environment for distributed systems. In 26th International Symposium on Fault-Tolerant Computing (FTCS), pages 404-414, Sendai, Japan, June 1996.
15. G. Kanawati, N. Kanawati and J. Abraham. FERRARI: A tool for the validation of system dependability properties. In Proceedings 22nd International Symposium Fault Tolerant Computing, pages 336-344, July 1992.
16. N. Kropp, P. Koopman and D. Siewiorek. Automated robustness testing of off-the-shelf software components. In 28th Fault Tolerant Computing Symposium, June 1998.
17. I. Krsul. Software Vulnerability Analysis. PhD thesis, Purdue University, Department of Computer Science, West Lafayette, Indiana, 1998.
18. R. R. Linde. Operating system penetration. In AFIPS National Computer Conference, pages pp. 361-368, 1975.
19. V. D. Gligor, C. S. Chandersekaran, W. Jiang, A. Johri, G. L. Luchenbaugh and L. E. Reich. A new security testing method and its application to the secure xenix kernel. IEEE Transactions on Software Engineering, SE-13(2):169-183, February 1987.
20. E. J. McCauley and P. J. Drongowski. The design of a secure operating system. In National Computer Conference, 1979.
21. C. E. Landwehr, A. R. Bull, J. P. McDermott and W. S. Choi. A taxonomy of computer program security flaws. ACM Computing Surveys, 26(3), September 1994.
22. A. Ghosh, T. O'Connor, G. McGraw. An automated approach for identifying potential vulnerabilities in software. In IEEE Symposium on Security and Privacy, Oakland, CA, 1998.
23. J. Voas, F. Charron, G. McGraw, K. Miller and M. Friedman. Predicting how badly "good" software can behave. IEEE Software, 14(4):73-83, August 1997.
24. B. Miller, D. Koski, C. Lee, V. Maganty, R. Murthy, A. Natarajan and J. Steidl. Fuzz revisited: A re-examination of the reliability of unix utilities and services. Technical report, Computer Sciences Department, University of Wisconsin, 1995.
25. C. Pfleeger, S. Pfleeger and M. Theofanos. A methodology for penetration testing. Computers and Security, 8(7):613-620, 1989.
26. S. Han, K. Shin and H. Rosenberg. Doctor: An integrated software fault injection environment for distributed real-time systems. Technical report, University of Michigan, Department of Elect. Engr. and Computer Science, 1995.
27. M. Hsueh, T. Tsai and R. Iyer. Fault injection techniques and tools. IEEE Computer, pages 75-82, April 1997.
28. J. Voas. Testing software for characteristics other than correctness: Safety, failure tolerance, and security. In Proc. of the Int'l Conference on Testing Computer Software, 1996.
29. J. Voas and G. McGraw. Software Fault Injection: Incoculating Programs Against Errors. John Wiley & Sons, Inc., 1998.