Automated security test generation with formal threat models

IEEE Transactions on Dependable and Secure Computing

Volumn 9, Issue 4, 2012, Pages 526-540

  Xu, Dianxiang ^a   Tu, Manghui ^a   Sanford, Michael ^a   Thomas, Lijo ^a   Woodraska, Daniel ^a   Xu, Weifeng ^b  

^a DAKOTA STATE UNIVERSITY   (United States)

^b GANNON UNIVERSITY   (United States)

Author keywords

KeywordsSoftware security; model based testing; Petri nets.; security testing; software testing; threat modeling

Indexed keywords

AUTOMATIC TEST PATTERN GENERATION; C++ (PROGRAMMING LANGUAGE); DENIAL-OF-SERVICE ATTACK; MODEL CHECKING; ONLINE SYSTEMS; PETRI NETS;

INFORMATION DISCLOSURE; KEYWORDSSOFTWARE SECURITY; MODEL BASED TESTING; MODEL IMPLEMENTATION; PREDICATE/TRANSITION NET; SECURITY TESTING; THREAT MODELING; VULNERABILITY DETECTION;

SOFTWARE TESTING;

EID: 84861136278     PISSN: 15455971     EISSN: None     Source Type: Journal    
DOI: 10.1109/TDSC.2012.24     Document Type: Article

References (47)

1. J.H. Andrews, L.C. Briand, and Y. Labiche, "Is Mutation an Appropriate Tool for Testing Experiments?," Proc. 27th Int'l Conf. Software Eng. (ICSE '05), pp. 402-411, 2005.
2. C. Bezemer, A. Mesbah, and A. van Deursen, "Automated Security Testing of Web Widget Interactions," Proc. Seventh Joint Meeting of the European Software Eng. Conf. and the ACM SIGSOFT Symp. Foundations of Software Eng. (ESE/FSE '09), pp. 81-90, 2009.
3. R.V. Binder, Testing Object-Oriented Systems: Models, Patterns, and Tools. Addison-Wesley, 2000.
4. M. Blackburn, R. Busser, A. Nauman, and R. Chandramouli, "Model-Based Approach to Security Test Automation," Proc. Int'l Software and Internet Quality Week Conf., June 2001.
5. R. Chandramouli and M. Blackburn, "Automated Testing of Security Functions Using a Combined Model & Interface Driven Approach," Proc. 37th Hawaii Int'l Conf. System Sciences, pp. 299-308, 2004.
6. O. El Ariss, J. Wu, and D. Xu, "Towards an Enhanced Design Level Security Integrating Attack Trees with Statecharts," Proc. Fifth IEEE Int'l Conf. Secure Software Integration and Reliability Improvement (SSIRI '11), June 2011.
7. J. Fonseca, M. Vieira, and H. Madeira, "Testing and Comparing Web Vulnerability Scanning Tools for SQL Injection and Xss Attacks," Proc. 13th Pacific Rim Int'l Symp. Dependable Computing, pp. 365-372, Dec. 2007.
8. H.J. Genrich, "Predicate/Transition Nets," Petri Nets: Central Models and Their Properties, pp. 207-247, Springer-Verlag, 1987.
9. P. Hope and B. Walther, Web Security Testing Cookbook: Systematic Techniques to Find Problems Fast. O' Reilly Media, Inc., 2009.
10. M. Howard and D. LeBlanc, Writing Secure Code, second ed. Microsoft Press, 2003.
11. H. Hu and G. Ahn, "Enabling Verification and Conformance Testing for Access Control Model," Proc. 13th ACM Symp. Access Control Models and Technologies, pp. 195-204, 2008.
12. V.C. Hu, E. Martin, J. Hwang, and T. Xie, "Conformance Checking of Access Control Policies Specified in XACML," Proc. First IEEE Int'l Workshop Security in Software Eng., 2007.
13. Y. Jia and M. Harman, "An Analysis and Survey of the Development of Mutation Testing," IEEE Trans. Software Eng., vol. 37, no. 5, pp. 649-678, Sept./Oct. 2011.
14. J. Julliand, P.A. Masson, and R. Tissot, "Generating Security Tests in Addition to Functional Tests," Proc. Third Int'l Workshop Automation of Software Test, pp. 41-44, 2008.
15. J. Jü rjens, "Model-Based Security Testing Using UMLsec," Electronic Notes in Theoretical Computer Science, vol. 220, no. 1, pp. 93-104, Dec. 2008.
16. A. Kieyzun, P.J. Guo, K. Jayaraman, and M.D. Ernst, "Automatic Creation of SQL Injection and Cross-Site Scripting Attacks," Proc. 31st Int'l Conf. Software Eng. (ICSE '09), May 2009.
17. J. Kong, D. Xu, and X. Zeng, "UML-Based Modeling and Analysis of Security Threats," Int'l J. Software Eng. and Knowledge Eng., vol. 20, no. 6, pp. 875-897, Sept. 2010.
18. Y. Le Traon, T. Mouelhi, and B. Baudry, "Testing Security Policies: Going Beyond Functional Testing," Proc. IEEE Int'l Symp. Software Reliability Eng. (ISSRE '07), 2007.
19. K. Li, L. Mounier, and R. Groz, "Test Generation from Security Policies Specified in Or-BAC," Proc. 31st Computer Software and Applications Conf. (COMPSAC '07), pp. 255-260, 2007. (Pubitemid 350301802)
20. W. Mallouli, J.M. Orset, A. Cavalli, N. Cuppens, and F. Cuppens, "A Formal Approach for Testing Security Rules," Proc. 12th ACM Symp. Access Control Models and Technologies, pp. 127-132, 2007. (Pubitemid 47281545)
21. A. Marback, H. Do, K. He, S. Kondamarri, and D. Xu, "Security Test Generation Using Threat Trees," Proc. Fourth Int'l Workshop Automation of Software Test (AST '09), May 2009.
22. E. Martin and T. Xie, "A Fault Model and Mutation Testing of Access Control Policies," Proc. 16th Int'l Conf. World Wide Web (WWW '07), pp. 667-676, May 2007. (Pubitemid 47582296)
23. M. Martin and M.S. Lam, "Automatic Generation of XSS and SQL Injection Attacks with Goal-Directed Model Checking," Proc. 17th Conf. Security Symp. (SS '08), pp. 31-43, 2008.
24. A. Masood, R. Bhatti, A. Ghafoor, and A. Mathur, "Scalable and Effective Test Generation for Role-Based Access Control Systems," IEEE Trans. Software Eng., vol. 35, no. 5, pp. 654-668, Sept./Oct. 2009.
25. A. Masood, A. Ghafoor, and A. Mathur, "Conformance Testing of Temporal Role-Based Access Control Systems," IEEE Trans. Dependable and Secure Computing, vol. 7, no. 2, pp. 144-158, Apr.-June 2010.
26. J.P. McDermott, "Attack Net Penetration Testing," Proc. Workshop New Security Paradigms, pp. 15-21, 2000.
27. T. Mouelhi, Y. Le Traon, and B. Baudry, "Mutation Analysis for Security Tests Qualification," Proc. Mutation '07: Third Workshop Mutation Analysis, 2007.
28. T. Murata, "Petri Nets: Properties, Analysis and Applications," Proc. IEEE, vol. 77, no. 4, pp. 541-580, Apr. 1989.
29. B. Potter, B. Allen, and G. Mcgraw, "Software Security Testing," IEEE Security & Privacy, pp. 32-36, Sept./Oct. 2004.
30. A. Pretschner and J. Philipps, "Methodological Issues in Model-Based Testing," Model-Based Testing of Reactive Systems, M. Broy, B. Jonsson, J.-P. Katoen, M. Leucker, A. Pretschner, eds., pp. 281-291, Springer-Verlag, 2005. (Pubitemid 350227431)
31. H. Robinson, "Graph Theory Techniques in Model-Based Testing," Proc. 16th Int'l Conf. and Exposition on Testing Computer Software (TCS '99), 1999.
32. B. Schneier, "Attack Trees," Dr. Dobb's J. Software Tools vol. 24, no. 12, pp. 21-29, 1999.
33. H. Shahriar and M. Zulkernine, "MUTEC: Mutation-Based Testing of Cross Site Scripting," Proc. ICSE Workshop Software Eng. for Secure Systems (SESS '09), pp. 47-53, May 2009.
34. H. Shahriar and M. Zulkernine, "Mitigating Program Security Vulnerabilities: Approaches and Challenges," ACM Computing Surveys, Sept. 2010.
35. H. Shahriar and M. Zulkernine, "MUSIC: Mutation-Based SQL Injection Vulnerability Checking," Proc. Eighth Int'l Conf. Quality Software (QSIC '08), pp. 77-86, Aug. 2008.
36. F. Swiderski and W. Snyder, Threat Modeling. Microsoft Press, 2004.
37. H.H. Thompson, "Why Security Testing Is Hard?," IEEE Security & Privacy Magazine, vol. 1, no. 4, pp. 83-86, July/Aug. 2003.
38. J. Thompson and J. Whittaker, "Testing for Software Security," Dr. Dobb's J., pp. 24-34, Nov. 2002. (Pubitemid 35172240)
39. K. Tsipenyuk, B. Chess, and G. McGraw, "Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors," Proc. Workshop Software Security Assurance Tools, Techniques, and Metrics, pp. 36-43, 2005.
40. J. Tuya, M. Suárez-Cabal, and C. Riva, "Mutating Database Queries," Information and Software Technology, vol. 49, no. 4, pp. 398-417, Apr. 2007. (Pubitemid 46164882)
41. M. Utting and B. Legeard, Practical Model-Based Testing: A Tools Approach. Morgan-Kaufmann. 2006.
42. L. Wang, W. Wong, and D. Xu, "A Threat Model Driven Approach for Security Testing," Proc. Third Int'l Workshop Software Eng. for Secure Systems (SESS '07), May 2007.
43. J.A. Whittaker and H.H. Thompson, How to Break Software Security. Addison Wesley, 2003.
44. D. Xu, "A Tool for Automated Test Code Generation from High-Level Petri Nets," Proc. 32nd Int'l Conf. Application and Theory of Petri Nets and Concurrency (Petri Nets '11), June 2011.
45. D. Xu and K.E. Nygard, "Threat-Driven Modeling and Verification of Secure Software Using Aspect-Oriented Petri Nets," IEEE Trans. Software Eng., vol. 32, no. 4, pp. 265-278, Apr. 2006.
46. D. Xu, "Software Security," Wiley Encyclopedia of Computer Science and Engineering, B.W. Wah, ed., vol. 5, pp. 2703-2716, John Wiley & Sons, Inc., Jan. 2009.
47. D. Xu, R.A. Volz, T.R. Ioerger, and J. Yen, "Modeling and Analyzing Multi-Agent Behaviors Using Predicate/Transition Nets," Int'l J. Software Eng. and Knowledge Eng., vol. 13, no. 1, pp. 103-124, Feb. 2003.