Attack pattern-based combinatorial testing

Abstract

The number of potential security threats rises with the increasing number of web applications, which cause tremendous financial and existential implications for developers and users as well. The biggest challenge for security testing is to specify and implement ways in order to detect potential vulnerabilities of the developed system in a never ending quest against new security threats but also to cover already known ones so that a program is suited against typical attack vectors. For these purposes many approaches have been developed in the area of model-based security testing in order to come up with solutions for real-world application problems. These approaches provide theoretical background as well as practical solutions for certain security issues. In this paper, we partially rely on previous work but focus on the representation of attack patterns using UML state diagrams. We extend previous work in combining the attack pattern models with combinatorial testing in order to provide concrete test input, which is submitted to the system under test. With combinatorial testing we capture different combinations of inputs and thus increasing the likelihood to find weaknesses in the implementation under test that can be exploited. Besides the foundations of our approach we further report on first experiments that indicate its practical use.

Evaluation of the IPO-Family algorithms for test case generation in web security testing

“…Furthermore, the paper includes a detailed case study for testing various SUTs against our automated testing method and a detailed evaluation and comparison of the two sets of test suites is presented. We also draw useful conclusions that indicate that combinatorial testing is an efficient approach for security testing, building on the comparison of the test results of the testing methods given in [4], [8], [5]. Most important we present an extensive analysis in terms of (total) vulnerabilities found by our generated test suites using the combinatorial coverage measurement (CCM) tool [9], where it is revealed that the indicated security leaks are mainly caused by the interaction of few parameters.…”

“…Finally, combinatorial testing has recently been employed as a method to model XSS attack vectors in [4], [8]. In detail, in [4] a novel combinatorial testing technique for generation of XSS attack vectors was first defined while in [8] the applicability of the previous technique has been further demonstrated by relaxing constraints and modelling white spaces in the attack grammar.…”

“…In [4] a novel method was described that combines an adapted combinatorial testing approach for the generation of test inputs according to a specified XSS grammar with a technique, which uses patterns of attacks for the execution of test cases called attack pattern-based testing. Because the initial results for tested applications were quite optimistic, we improved that approach by extending the input grammar and adding constraints between the input parameter values in [5].…”

“…Then, we derive four concrete sets of test suites as inputs for SUTs from the generated combinatorial structures, each two of them generated via the IPOG and the IPOG-F algorithm, respectively, also depending on whether they have constraints or not. The subsequent test execution is performed by the automated method first given in [4].…”

Attack Patterns for Black-Box Security Testing of Multi-Party Web Applications

“…Bozic et al [28] proposed attack pattern-based combinatorial testing for detecting XSS vulnerabilities in web applications. In order to increase the coverage of our attack patterns, we applied the concept of combinatorial testing, as mentioned in Section III.…”