Improving Software Security Using Search-Based Refactoring

Abstract

Abstract. Security metrics have been proposed to assess the security of software applications based on the principles of "reduce attack surface" and "grant least privilege." While these metrics can help inform the developer in choosing designs that provide better security, they cannot on their own show exactly how to make an application more secure. Even if they could, the onerous task of updating the software to improve its security is left to the developer. In this paper we present an approach to automated improvement of software security based on search-based refactoring. We use the search-based refactoring platform, Code-Imp, to refactor the code in a fully-automated fashion. The fitness function used to guide the search is based on a number of software security metrics. The purpose is to improve the security of the software immediately prior to its release and deployment. To test the value of this approach we apply it to an industrial banking application that has a strong security dimension, namely Wife. The results show an average improvement of 27.5% in the metrics examined. A more detailed analysis reveals that 15.5% of metric improvement results in real improvement in program security, while the remaining 12% of metric improvement is attributable to hitherto undocumented weaknesses in the security metrics themselves.

A survey of search-based refactoring for software maintenance

“…The minipatterns would be reused if applicable for other pattern transformations. The authors analyzed the (Gamma et al, 1994) patterns to determine whether a suitable transformation could be built with the applicable mini transformations. They found that while the tool generally worked well for the creational patterns, structural patterns and behavioral patterns caused problems.…”

“…There is the method where problems are first detected in the code and then either refactoring options are generated in order to be applied manually Kessentini et al, 2012;Ouni et al, 2012;Wang et al, 2015;Mkaouer et al, 2016;Griffith et al, 2011) or the problems are addressed automatically (Di Penta, 2005). Koc et al, 2012;Mohan et al, 2016;O'Keeffe & Cinnéide, 2007b;Ghaith & Cinnéide, 2012;Cinnéide et al, 2012;Cinnéide et al, 2016;Veerappa & Harrison, 2013;Fatiregun et al, 2004) or again, using this approach to suggest refactorings to apply (Harman & Tratt, 2007;Seng et al, 2006;. Figure 5 identifies the number of papers that use each type of search technique, with GAs, GP and GEAs again encapsulated as EAs and PSO and ABC encapsulated as SOAs.…”

“…The majority only used one, at 24 papers, although 15 other papers that did use search techniques used more than one. Of these, 12 papers (O' Keeffe & Cinnéide, 2006;O'Keeffe & Cinnéide, 2008a;O'Keeffe & Cinnéide, 2007a;O'Keeffe & Cinnéide, 2008b;Koc et al, 2012;Mohan et al, 2016;Ghaith & Cinnéide, 2012;Mkaouer et al, 2016;Fatiregun et al, 2004) directly compared the different search techniques against each other to speculate on the most applicable. Only one study looked at four separate search techniques.…”

“…The A-CMA tool was proposed by (Koc et al, 2012) and then adapted and used by Mohan, Greer and McMullan (Mohan et al, 2016). The CODe-Imp tool was used in a myriad of studies O'Keeffe and Cinnéide, 2006, O'Keeffe and Cinnéide, 2008a, O'Keeffe and Cinnéide, 2007a, O'Keeffe and Cinnéide, 2008b, O'Keeffe and Cinnéide, 2007b, Ghaith and Cinnéide, 2012, Veerappa and Harrison, 2013. A precursor to CODe-Imp, DPT, was also present in three different papers Cinnéide and Nixon, 1999a, Cinnéide and Nixon, 1999b, Cinnéide, 2000.…”

A Genetic Algorithm to Find the Adequate Granularity for Service Interfaces

“…For instance, Ghannem et al [7] found appropriate refactoring suggestions using a set of refactoring examples. Their approach is based on an Interactive Genetic Algorithm which enables to interact with users and integrate their feedbacks into a classic GA. Ghaith et al [6] presented an approach to automate improvements of software security based on search-based refactoring. O'Keeffe et al [17] have constructed a software tool capable of refactoring objectoriented systems.…”