Configuration fuzzing for software vulnerability detection

ARES 2010 - 5th International Conference on Availability, Reliability, and Security

Volumn , Issue , 2010, Pages 525-530

  Dai, Huning ^a   Murphy, Christian ^a   Kaiser, Gail ^a  

^a Department of Earth and Environmental Sciences   (United States)

Author keywords

Configuration fuzzing; Fuzz testing; In vivo testing; Security invariants; Vulnerability

Indexed keywords

FUZZ TESTING; IN-VIVO; INPUT SPACE; RUNNING APPLICATIONS; RUNTIME ENVIRONMENTS; SOFTWARE APPLICATIONS; SOFTWARE SECURITY; SOFTWARE VULNERABILITIES; TESTING METHODOLOGY; TESTING TECHNIQUE;

COMPUTER SOFTWARE; TESTING;

SECURITY OF DATA;

EID: 77952329885     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ARES.2010.22     Document Type: Conference Paper

References (20)

1. M. Sutton, A. Greene, and P. Amini, Fuzzing: Brute Force Vulnerability Discovery, 1st ed. Addison-Wesley Professional, 2007.
2. L. Jurani, "Using fuzzing to detect security vulnerabilities," INFIGO, Tech. Rep. INFIGO-TD-01-04-2006, 2006.
3. T. Clarke, "Fuzzing for software vulnerability discovery," Department of Mathematic, Royal Holloway, University of London, Tech. Rep. RHUL-MA-2009-4, 2009.
4. J. Biskup, Security in computing systems challenges, approaches, and solutions. Springer-Verlag Berlin Heidelberg, 2009.
5. C. Ramakrishnan and R. Sekar, "Model-based analysis of configuration vulnerabilities," Journal of Computer Security, vol. 10, pp. 189-209, 2002.
6. C. Murphy, G. Kaiser, I. Vo, and M. Chu, "Quality assurance of software applications using the in vivo testing approach," in Proc. of the Second IEEE International Conference on Software Testing, Verification and Validation (ICST), 2009, pp. 111-120.
7. D. Rubenstein, L. Osterweil, and S. Zilberstein, "An anytime approach to analyzing software systems," in Proc. of 10th FLAIRS, 1997, pp. 386-391.
8. S. Osman, D. Subhraveti, G. Su, and J. Nieh, "The design and implementation of Zap: A system for migrating computing environments," in Proc of the Fifth Symposium on Operating Systems Design and Implementation (OSDI), 2002, pp. 361-376.
9. O. Laadan, R. A. Baratto, D. B. Phung, S. Potter, and J. Nieh, "Dejaview: a personal virtual computer recorder," in SOSP '07: Proceedings of twenty-first ACM SIGOPS symposium on Operating systems principles. New York, NY, USA: ACM, 2007, pp. 279-292.
10. M. Chu, C. Murphy, and G. Kaiser, "Distributed in vivo testing of software applications," in Proc. of the First International Conference on Software Testing, Verification and Validation, April 2008, pp. 509-512.
11. M. E. Locasto, S. Sidiroglou, and A.D. Keromytis, "Software self-healing using collaborative application communities," in Proc. of the Internet Society (ISOC) Symposium on Network and Distributed Systems Security (NDSS 2006), February 2006, pp. 95-106.
12. R. Griffith and G. Kaiser, "A runtime adaptation framework for native C and bytecode applications," in 3rd IEEE International Conference on Autonomic Computing, June 2006, pp. 93-103.
13. A. Hartman, Graph Theory, Combinatorics and Algorithms. Springer US, 2005, vol. 34, pp. 237-266.
14. "Putty," http://www.chiark.greenend.org.uk/sgtatham/putty.
15. M.-C. Hsueh, T. K. Tsai, and R. K. Iyer, "Fault injection techniques and tools," Computer, vol. 30, no. 4, pp. 75-82, 1997.
16. W. Du and A. P. Mathur, "Testing for software vulnerability using environment perturbation," in Proc of International Conference on Dependable Systems and Networks, 2000, p. 603.
17. H. H. Thompson, J. A. Whittaker, and F. E. Mottay, "Software security vulnerability testing in hostile environments," in Proceedings of the 2002 ACM symposium on Applied computing. New York, NY, USA: ACM, 2002, pp. 260-264.
18. V. Ganesh, T. Leek, and M. Rinard, "Taint-based directed whitebox fuzzing," in ICSE '09: Proceedings of the 2009 IEEE 31st International Conference on Software Engineering. Washington, DC, USA: IEEE Computer Society, 2009, pp. 474-484.
19. P. Godefroid, M. Y. Levin, and D. A. Molnar, "Automated whitebox fuzz testing," in Network Distributed Security Symposium (NDSS). Internet Society, 2008.
20. A. Memon and A. Porter et al., "Skoll: distributed continuous quality assurance," in Proc. of the 26th International Conference on Software Engineering (ICSE), May 2004, pp. 459-468.