nach oben

Erschienen in:

2019 | OriginalPaper | Buchkapitel

A Fault-Driven Combinatorial Process for Model Evolution in XSS Vulnerability Detection

verfasst von : Bernhard Garn, Marco Radavelli, Angelo Gargantini, Manuel Leithner, Dimitris E. Simos

Erschienen in: Advances and Trends in Artificial Intelligence. From Theory to Practice

Verlag: Springer International Publishing

Einloggen

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config

KI-gestützte Suche

Aus

Abstract

We consider the case where a knowledge base consists of interactions among parameter values in an input parameter model for web application security testing. The input model gives rise to attack strings to be used for exploiting XSS vulnerabilities, a critical threat towards the security of web applications. Testing results are then annotated with a vulnerability triggering or non-triggering classification, and such security knowledge findings are added back to the knowledge base, making the resulting attack capabilities superior for newly requested input models. We present our approach as an iterative process that evolves an input model for security testing. Empirical evaluation on six real-world web application shows that the process effectively evolves a knowledge base for XSS vulnerability detection, achieving on average 78.8% accuracy.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Online-Abonnement

Mit Springer Professional "Wirtschaft+Technik" erhalten Sie Zugriff auf:

über 102.000 Bücher
über 537 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Finance + Banking
Management + Führung
Marketing + Vertrieb
Maschinenbau + Werkstoffe
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Technik"

Online-Abonnement

Mit Springer Professional "Technik" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 390 Zeitschriften

aus folgenden Fachgebieten:

Automobil + Motoren
Bauwesen + Immobilien
Business IT + Informatik
Elektrotechnik + Elektronik
Energie + Nachhaltigkeit
Maschinenbau + Werkstoffe

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Springer Professional "Wirtschaft"

Online-Abonnement

Mit Springer Professional "Wirtschaft" erhalten Sie Zugriff auf:

über 67.000 Bücher
über 340 Zeitschriften

aus folgenden Fachgebieten:

Bauwesen + Immobilien
Business IT + Informatik
Finance + Banking
Management + Führung
Marketing + Vertrieb
Versicherung + Risiko

Jetzt Wissensvorsprung sichern!

Jetzt informieren

Vorheriges Kapitel Practical Obstacle Avoidance Path Planning for Agriculture UAVs

Nächstes Kapitel An Efficient Algorithm for Deriving Frequent Itemsets from Lossless Condensed Representation

PhantomJS (http://phantomjs.org/) is a headless browser environment enabling introspection of events such as network requests, document edits and JavaScript errors.

In theory, any valid JavaScript functions that will not be called during the normal operation of the SUT can be chosen instead.

Note that \(t_{BEN}\) is different from the strength t for generating the initial test suite.

In this case, we believe that the suspiciousness average and standard deviation could be useful indicators of the \(F_1\) score that the currently inferred model may have.

WAVSEP: Web Application Vulnerability Scanner Evaluation Project, https://github.com/sectooladdict/wavsep.

The tests suites were generated using the IpoF algorithm, implemented in ACTS.

Arcaini, P., Gargantini, A., Radavelli, M.: Efficient and guaranteed detection of t-way failure-inducing combinations. In: IEEE International Conference on Software Testing, Verification and Validation ICST Workshops (2019)

Bozic, J., Garn, B., Kapsalis, I., Simos, D., Winkler, S., Wotawa, F.: Attack pattern-based combinatorial testing with constraints for web security testing. In: IEEE International Conference on Software Quality, Reliability and Security (2015)

Catteddu, D.: Cloud computing: benefits, risks and recommendations for information security. In: Serrão, C., Aguilera Díaz, V., Cerullo, F. (eds.) IBWAS 2009. CCIS, vol. 72, pp. 17–17. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-16120-9_9CrossRef

Duchene, F., Groz, R., Rawat, S., Richier, J.-L.: XSS vulnerability detection using model inference assisted evolutionary fuzzing. In IEEE International Conference on Software Testing, Verification and Validation (ICST), pp. 815–817 (2012)

O. Foundation: OWASP Top 10 2017. https://www.owasp.org/index.php/Top_10-2017_A7-Cross-Site_Scripting_(XSS). Accessed 19 Apr 2018

Gargantini, A., Petke, J., Radavelli, M.: Combinatorial interaction testing for automated constraint repair. In: IEEE International Confernce on Software Testing, Verification and Validation ICST Workshops, pp. 239–248 (2017)

Gargantini, A., Radavelli, M.: Migrating combinatorial interaction test modeling and generation to the web. In: IEEE International Conference on Software Testing, Verification and Validation ICST Workshops, pp. 308–317 (2018)

Garn, B., Kapsalis, I., Simos, D.E., Winkler, S.: On the applicability of combinatorial testing to web application security testing: a case study. In: Proceedings of the 2014 Workshop on Joining AcadeMiA and Industry Contributions to Test Automation and Model-Based Testing, pp. 16–21. ACM (2014)

Ghandehari, L.S., Lei, Y., Kacker, R., Kuhn, D.R.R., Kung, D., Xie, T.: A combinatorial testing-based approach to fault localization. IEEE Trans. Softw. Eng. (2018)

10.

Jia, Y., Cohen, M.B., Harman, M., Petke, J.: Learning combinatorial interaction test generation strategies using hyperheuristic search. In: Proceedings of the International Conference on Software Engineering - Volume 1, ICSE 2015, pp. 540–550 (2015)

11.

Kuhn, D., Kacker, R., Lei, Y.: Introduction to Combinatorial Testing. Chapman & Hall/CRC, London (2013)MATH

12.

Melicher, W., Das, A., Sharif, M., Bauer, L., Jia, L.: Riding out DOMsday: towards detecting and preventing DOM cross-site scripting. In: Proceedings of Network and Distributed System Security Symposium. Internet Society (2018)

13.

Simos, D.E., Kleine, K., Ghandehari, L.S.G., Garn, B., Lei, Y.: A combinatorial approach to analyzing cross-site scripting (XSS) vulnerabilities in web application security testing. In: Wotawa, F., Nica, M., Kushik, N. (eds.) ICTSS 2016. LNCS, vol. 9976, pp. 70–85. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-47443-4_5CrossRef

14.

Simos, D.E., Kuhn, R., Voyiatzis, A.G., Kacker, R.: Combinatorial methods in security testing. IEEE Comput. 49, 40–43 (2016)CrossRef

15.

Temple, P., Galindo, J.A., Acher, M., Jézéquel, J.-M.: Using machine learning to infer constraints for product lines. In: Proceedings of the 20th International Systems and Software Product Line Conference, pp. 209–218. ACM (2016)

16.

Yu, L., Lei, Y., Kacker, R.N., Kuhn, D.R.: ACTS: a combinatorial test generation tool. In: IEEE International Conference on Software Testing, Verification and Validation (2013)

Titel: A Fault-Driven Combinatorial Process for Model Evolution in XSS Vulnerability Detection
verfasst von: Bernhard Garn
Marco Radavelli
Angelo Gargantini
Manuel Leithner
Dimitris E. Simos
Verlag: Springer International Publishing
Buch: Advances and Trends in Artificial Intelligence. From Theory to Practice
Print ISBN: 978-3-030-22998-6

Electronic ISBN: 978-3-030-22999-3

Copyright-Jahr: 2019
DOI: https://doi.org/10.1007/978-3-030-22999-3_19

Springer Professional

Abstract

Bitte loggen Sie sich ein, um Zugang zu Ihrer Lizenz zu erhalten.

Sie haben noch keine Lizenz? Dann Informieren Sie sich jetzt über unsere Produkte:

Springer Professional "Wirtschaft+Technik"

Springer Professional "Technik"

Springer Professional "Wirtschaft"

Premium Partner