Rule-based auditing system for software security assurance

Jang, Changbok; Kim, Jeongseok; Jang, Hyokyung; Park, Sundo; Jang, Bokman; Kim, Bonghoi; Choi, Euiin

doi:10.1109/icufn.2009.5174311

“…We are aware of two closely related works that assess risk using a rule-based approach (Jang et al, 2009, Shahriar & Zulkernine, 2011. Notably, the work of Jang et al, (2009) develops a rulebased security assurance system.…”

Section: Related Workmentioning

confidence: 99%

“…We are aware of two closely related works that assess risk using a rule-based approach (Jang et al, 2009, Shahriar & Zulkernine, 2011. Notably, the work of Jang et al, (2009) develops a rulebased security assurance system. It relies on extracting the exploitation paths of an application, and then it represents the path as a Finite State Automata (FSA) that can be used as rule-based signatures to detect exploitations.…”

Section: Related Workmentioning

confidence: 99%

Fuzzy Rule-Based Vulnerability Assessment Framework for Web Applications

Shahriar

¹

,

Haddad

²

2016

International Journal of Secure Software Engineering

View full text Add to dashboard Cite

This paper addresses the problem of assessing risk in web application due to implementation level vulnerabilities. In particular, the authors address the common research challenge of finding enough historical data to compute the probability of vulnerabilities and exploitations. They develop a Fuzzy Logic based System (FLS)1 to compute the risk uniformly and to address the diversity of risks. The authors propose a set of crisp metrics that are used to define fuzzy sets. They also develop a set of rule-bases to assess the risk level. The proposed FLS can be a useful tool to aid application developers and industry practitioners to assess the risk and plan ahead for employing necessary mitigation approaches. The authors evaluate their proposed approach using three real-world web applications implemented in PHP, and apply it to four types of common vulnerabilities. The initial results indicate that the proposed FLS approach can effectively discover high risk applications.

show abstract

Fuzzy Rule-Based Vulnerability Assessment Framework for Web Applications

Shahriar

¹

,

Haddad

²

2018

Application Development and Design

1

0

View full text Add to dashboard Cite

This paper addresses the problem of assessing risk in web application due to implementation level vulnerabilities. In particular, the authors address the common research challenge of finding enough historical data to compute the probability of vulnerabilities and exploitations. They develop a Fuzzy Logic based System (FLS)1 to compute the risk uniformly and to address the diversity of risks. The authors propose a set of crisp metrics that are used to define fuzzy sets. They also develop a set of rule-bases to assess the risk level. The proposed FLS can be a useful tool to aid application developers and industry practitioners to assess the risk and plan ahead for employing necessary mitigation approaches. The authors evaluate their proposed approach using three real-world web applications implemented in PHP, and apply it to four types of common vulnerabilities. The initial results indicate that the proposed FLS approach can effectively discover high risk applications.

show abstract