Generic Approach for Security Error Detection Based on Learned System Behavior Models for Automated Security Tests

Christian Schanes, Andreas Hübler, Florian Fankhauser, Thomas Grechenig
DB

Abstract

The increasing complexity of software and IT systems creates the necessity for research on technologies addressing current key security challenges. To meet security requirements in IT infrastructures, a security engineering process has to be established. One crucial factor contributing to a higher level of security is the reliable detection of security vulnerabilities during security tests. In the presented approach, we observe the behavior of the system under test and introduce machine learning methods based on derived behavior metrics. This is a generic method for different test targets which improves the accuracy of the security test result of an automated security testing approach. Reliable automated determination of security failures in security test results increases the security quality of the tested software and avoids costly manual validation.

Type
Conference paper
Publication
Talk: Sixth IEEE International Conference on Software Testing, Verification and Validation (ICST 2013), Luxembourg; 03-18-2013 - 03-22-2013; in: “Proceedings of the Sixth IEEE International Conference on Software Testing, Verification and Validation”, IEEE, (2013), ISBN: 978-1-4799-1324-4; 453 - 460
Christian Schanes
Projektass. Dipl.-Ing. Dr.techn.
Florian Fankhauser
Projektass. Dipl.-Ing.
Thomas Grechenig
Thomas Grechenig
Ao.Univ.Prof. Dipl.-Ing. Dr.techn.