The paper proposes a security testing technique to detect known vulnerabilities of web applications using both static and dynamic analysis. We also present a process to improve the security of web applications by mitigating many of the vulnerabilities revealed in the testing phase, and address a new method for detecting unknown vulnerabilities by applying dynamic black-box testing based on a fu...

Fuzzing is an approach to software testing where the system being tested is bombarded with test cases generated by another program. The system is then monitored for any flaws exposed by the processing of this input. While the fundamental principles of fuzzing have not changed since the term was first coined, the complexity of the mechanisms used to drive the fuzzing process have undergone signi...

With the rapid development of Industrial Internet Things (IIoT), programmable logic controllers (PLCs) are becoming increasingly intelligent, leading to improved productivity. However, this also brings about a growing number security vulnerabilities. As result, efficiently identifying potential vulnerabilities in PLCs has become crucial research topic for researchers. This article proposes meth...

Vulnerable software represents a tremendous threat to modern information systems. Vulnerabilities in widespread applications may be used to spread malware, steal money and conduct target attacks. To address this problem, developers and researchers use different approaches of dynamic and static software analysis; one of these approaches is called fuzzing. Fuzzing is performed by generating and s...

Fuzzing is the process of finding security vulnerabilities in input-processing code by repeatedly testing the code with modified inputs. In this paper, we formalize fuzzing as a reinforcement learning problem using the concept of Markov decision processes. This in turn allows us to apply state-of-theart deep Q-learning algorithms that optimize rewards, which we define from runtime properties of...

Recent efforts in practical symbolic execution have successfully mitigated the path-explosion problem to some extent with search-based heuristics and compositional approaches. Similarly, due to an increase in the performance of cheap multi-core commodity computers, fuzzing as a viable method of random mutation-based testing has also seen promise. However, the possibility of combining symbolic e...

Formal techniques have been devoted to analyzing whether network protocol specifications violate security policies; however, these methods cannot detect vulnerabilities in the implementations of the network protocols themselves. Symbolic execution can be used to analyze the paths of the network protocol implementations, but for stateful network protocols, it is difficult to reach the deep state...

Fuzzing network servers is a technical challenge, since the behavior of target server depends on its state over sequence multiple messages. Existing solutions are costly and difficult to use, as they rely manually-customized artifacts such protocol models, parsers, learning frameworks. The aim this work develop greybox fuzzer (StateaAFL) for that only relies lightweight analysis program, with n...

Network protocols, as the communication rules among computer network devices, are foundation for normal operation of networks. However, security issues arising from design flaws and implementation vulnerabilities in protocols pose significant risks to operations security. protocol fuzzing is an effective technique discovering mitigating protocols. It offers unparalleled advantages compared othe...

Zigbee is widely adopted as a resource-efficient wireless protocol in the IoT network. devices from manufacturers have recently been affected due to major vulnerabilities implementations. Security testing of implementations becoming increasingly important. However, applying existing vulnerability detection techniques such fuzzing not simple task. Dealing with low-level hardware events still rem...