Locating Software Features in a SOA Composite Application

Coffey, John W.; White, Laura; Wilde, Norman; Simmons, Sharon

doi:10.1109/ecows.2010.28

Cited by 23 publications

(7 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…HotelRS is a SOA (service-oriented architecture) based system providing web services for room reservation and was developed and used in [9]. Cyclos is a popular open source Java/Servlet Web Application for ecommerce and online payment 7 .…”

Section: A Subject Applicationsmentioning

confidence: 99%

Behind an Application Firewall, Are We Safe from SQL Injection Attacks?

Appelt

Nguyen

Briand

2015

2015 IEEE 8th International Conference on Software Testing, Verification and Validation (ICST)

View full text Add to dashboard Cite

Web application firewalls are an indispensable layer to protect online systems from attacks. However, the fast pace at which new kinds of attacks appear and their sophistication require that firewalls be updated and tested regularly as otherwise they will be circumvented. In this paper, we focus our research on web application firewalls and SQL injection attacks. We present a machine learning-based testing approach to detect holes in firewalls that let SQL injection attacks bypass. At the beginning, the approach can automatically generate diverse attack payloads, which can be seeded into inputs of web-based applications, and then submit them to a system that is protected by a firewall. Incrementally learning from the tests that are blocked or passed by the firewall, our approach can then select tests that exhibit characteristics associated with bypassing the firewall and mutate them to efficiently generate new bypassing attacks. In the race against cyber attacks, time is vital. Being able to learn and anticipate more attacks that can circumvent a firewall in a timely manner is very important in order to quickly fix or fine-tune the firewall. We developed a tool that implements the approach and evaluated it on ModSecurity, a widely used application firewall. The results we obtained suggest a good performance and efficiency in detecting holes in the firewall that could let SQLi attacks go undetected.

show abstract

Section: A Subject Applicationsmentioning

confidence: 99%

Behind an Application Firewall, Are We Safe from SQL Injection Attacks?

Appelt

Nguyen

Briand

2015

2015 IEEE 8th International Conference on Software Testing, Verification and Validation (ICST)

View full text Add to dashboard Cite

show abstract

“…HotelRS was created by researchers to study service-oriented architectures and was used in previous studies [8]. SugarCRM is a popular customer relationship management system (received 189K+ downloads as of 2013 8 ).…”

Section: Subject Applicationsmentioning

confidence: 99%

Automated testing for SQL injection vulnerabilities: an input mutation approach

Appelt

Nguyen

Briand

et al. 2014

Proceedings of the 2014 International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

Web services are increasingly adopted in various domains, from finance and e-government to social media. As they are built on top of the web technologies, they suffer also an unprecedented amount of attacks and exploitations like the Web. Among the attacks, those that target SQL injection vulnerabilities have consistently been top-ranked for the last years. Testing to detect such vulnerabilities before making web services public is crucial. We present in this paper an automated testing approach, namely µ4SQLi, and its underpinning set of mutation operators. µ4SQLi can produce effective inputs that lead to executable and harmful SQL statements. Executability is key as otherwise no injection vulnerability can be exploited. Our evaluation demonstrated that the approach is effective to detect SQL injection vulnerabilities and to produce inputs that bypass application firewalls, which is a common configuration in real world.

show abstract

“…The goal of the SCHub project (Social Collaboration Hub, funded by the BMBF as part of the FHprofUnt funding, https://www.sc-hub.de) is to develop a distribution-like collaboration solution based on open source software (OSS) that provides end-users with a consistent experience across all systems while using a modular micro-service approach (Cockcroft, 2014). It therefore represents a composite application (Coffey et al, 2010). The solution will be available as Software as a Service (SaaS) in the cloud as well as on premise installation.…”

Section: Case Descriptionmentioning

confidence: 99%

The Docker Ecosystem Needs Consolidation

Peinl¹,

Holzschuher²

2015

Proceedings of the 5th International Conference on Cloud Computing and Services Science

View full text Add to dashboard Cite

Docker provides a good basis to run composite applications in the cloud, especially if those are not cloudaware, or cloud-native. However, Docker concentrates on managing containers on one host, but SaaS providers need a container management solution for multiple hosts. Therefore, a number of tools emerged that claim to solve the problem. This paper classifies the solutions, maps them to requirements from a case study and identifies gaps and integration requirements. We conclude that the Docker ecosystem could help moving from IaaS and PaaS solutions towards a runtime environment for SaaS applications, but needs consolidation.

show abstract

Locating Software Features in a SOA Composite Application

Cited by 23 publications

References 16 publications

Behind an Application Firewall, Are We Safe from SQL Injection Attacks?

Behind an Application Firewall, Are We Safe from SQL Injection Attacks?

Automated testing for SQL injection vulnerabilities: an input mutation approach

The Docker Ecosystem Needs Consolidation

Contact Info

Product

Resources

About