Testing for Software Vulnerability Using Environment Perturbation
ثبت نشده
چکیده
We describe an methodology for testing a software system for possible security flaws. Traditionally, security testing is done using penetration analysis and formal methods. Based on the observation that most security flaws are triggered due to a flawed interaction with the environment, we view the security testing problem as the problem of testing for the fault-tolerance properties of a software system. We consider each environment perturbation as a fault and the resulting security compromise a failure in the toleration of such faults. Our approach is based on the well known technique of fault-injection. Environment faults are injected into the system under test and system behavior observed. The failure to tolerate faults is an indicator of a potential security flaw in the system. An Environment-Application Interaction (EAI) fault model is proposed which guides us to decide what faults to inject. Based on EAI, we have developed a security testing methodology, and apply it to several applications. We successfully identified a number of vulnerabilities include vulnerabilities in Windows NT operating system.
منابع مشابه
Testing for Software Vulnerability Using Environment Perturbation
We describe an methodology for testing a software system for possible security flaws. Based on the observation that most security flaws are caused by the program’s inappropriate interactions with the environment, and triggered by user’s malicious perturbation on the environment (which we call an environment fault), we view the security testing problem as the problem of testing for the fault-tol...
متن کاملVulnerability Testing of Software System Using Fault Injection
We describe an approach for testing a software system for possible security flaws. Traditionally, security testing is done using penetration analysis and formal methods. Based on the observation that most security flaws are triggered due to a flawed interaction with the environment, we view the security testing problem as the problem of testing for the fault-tolerance properties of a software s...
متن کاملCONFU: Configuration Fuzzing Testing Framework for Software Vulnerability Detection
Many software security vulnerabilities only reveal themselves under certain conditions, i.e., particular configurations and inputs together with a certain runtime environment. One approach to detecting these vulnerabilities is fuzz testing. However, typical fuzz testing makes no guarantees regarding the syntactic and semantic validity of the input, or of how much of the input space will be expl...
متن کاملAssessment of Social Vulnerability to the adverse effects of air pollution: A case study: Sistan Plain
Background & Aim: The Sistan region with over 320 dry days is one of the focal points of the rainstorms, and every year the number of days with dust increases, which results in socio-economic consequences for more than 400,000 people in the region. This study investigated the social vulnerability of the population to air pollution with a different perspective. Methods: The present study is a d...
متن کاملذخیره در منابع من
با ذخیره ی این منبع در منابع من، دسترسی به آن را برای استفاده های بعدی آسان تر کنید
عنوان ژورنال:
دوره شماره
صفحات -
تاریخ انتشار 1999