What You Always Wanted to Know About Datalog (And Never Dared to Ask)
IEEE Transactions on Knowledge and Data Engineering
SecureUML: A UML-Based Modeling Language for Model-Driven Security
UML '02 Proceedings of the 5th International Conference on The Unified Modeling Language
Using Abuse Case Models for Security Requirements Analysis
ACSAC '99 Proceedings of the 15th Annual Computer Security Applications Conference
Passive testing and applications to network management
ICNP '97 Proceedings of the 1997 International Conference on Network Protocols (ICNP '97)
Inside the Windows Security Push
IEEE Security and Privacy
Fault Identification in Networks by Passive Testing
SS '01 Proceedings of the 34th Annual Simulation Symposium (SS01)
Security-Critical System Development with Extended Use Cases
APSEC '03 Proceedings of the Tenth Asia-Pacific Software Engineering Conference Software Engineering Conference
Tropos: An Agent-Oriented Software Development Methodology
Autonomous Agents and Multi-Agent Systems
Threat Modeling
Eliciting security requirements with misuse cases
Requirements Engineering
Application Penetration Testing
IEEE Security and Privacy
Verification and change-impact analysis of access-control policies
Proceedings of the 27th international conference on Software engineering
An Enhanced Passive Testing Approach for Network Protocols
ICNICONSMCL '06 Proceedings of the International Conference on Networking, International Conference on Systems and International Conference on Mobile Communications and Learning Technologies
Modeling Software VulnerabilitiesWith Vulnerability Cause Graphs
ICSM '06 Proceedings of the 22nd IEEE International Conference on Software Maintenance
EXE: automatically generating inputs of death
Proceedings of the 13th ACM conference on Computer and communications security
Design of a Process for Software Security
ARES '07 Proceedings of the The Second International Conference on Availability, Reliability and Security
The Daikon system for dynamic detection of likely invariants
Science of Computer Programming
Flayer: exposing application internals
WOOT '07 Proceedings of the first USENIX workshop on Offensive Technologies
SAT-based model-checking for security protocols analysis
International Journal of Information Security
Analysis of software vulnerability
ISP'06 Proceedings of the 5th WSEAS International Conference on Information Security and Privacy
Dynamic taint propagation: Finding vulnerabilities without attacking
Information Security Tech. Report
A Cause-Based Approach to Preventing Software Vulnerabilities
ARES '08 Proceedings of the 2008 Third International Conference on Availability, Reliability and Security
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications
SP '08 Proceedings of the 2008 IEEE Symposium on Security and Privacy
Model-Checking for Software Vulnerabilities Detection with Multi-Language Support
PST '08 Proceedings of the 2008 Sixth Annual Conference on Privacy, Security and Trust
Automating Software Testing Using Program Analysis
IEEE Software
Two Complementary Tools for the Formal Testing of Distributed Systems with Time Constraints
DS-RT '08 Proceedings of the 2008 12th IEEE/ACM International Symposium on Distributed Simulation and Real-Time Applications
HASE '08 Proceedings of the 2008 11th IEEE High Assurance Systems Engineering Symposium
A passive testing approach based on invariants: application to the WAP
Computer Networks: The International Journal of Computer and Telecommunications Networking
Automated Security Protocol Analysis With the AVISPA Tool
Electronic Notes in Theoretical Computer Science (ENTCS)
Unified modeling of attacks, vulnerabilities and security activities
Proceedings of the 2010 ICSE Workshop on Software Engineering for Secure Systems
Secure Systems Development with UML
Secure Systems Development with UML
An open extensible tool environment for event-b
ICFEM'06 Proceedings of the 8th international conference on Formal Methods and Software Engineering
Evaluating access control policies through model checking
ISC'05 Proceedings of the 8th international conference on Information Security
ICISC'05 Proceedings of the 8th international conference on Information Security and Cryptology
| Hi-index | 0.00 |
Context: Passive testing is a technique in which traces collected from the execution of a system under test are examined for evidence of flaws in the system. Objective: In this paper we present a method for detecting the presence of security vulnerabilities by detecting evidence of their causes in execution traces. This is a new approach to security vulnerability detection. Method: Our method uses formal models of vulnerability causes, known as security goal models and vulnerability detection conditions (VDCs). The former are used to identify the causes of vulnerabilities and model their dependencies, and the latter to give a formal interpretation that is suitable for vulnerability detection using passive testing techniques. We have implemented modeling tools for security goal models and vulnerability detection conditions, as well as TestInv-Code, a tool that checks execution traces of compiled programs for evidence of VDCs. Results: We present the full definitions of security goal models and vulnerability detection conditions, as well as structured methods for creating both. We describe the design and implementation of TestInv-Code. Finally we show results obtained from running TestInv-Code to detect typical vulnerabilities in several open source projects. By testing versions with known vulnerabilities, we can quantify the effectiveness of the approach. Conclusion: Although the current implementation has some limitations, passive testing for vulnerability detection works well, and using models as the basis for testing ensures that users of the testing tool can easily extend it to handle new vulnerabilities.