The Current and Future of Software Securities and Vulnerabilities

As it has been stepping into the e-time period, software, which is considered as the key factor of the network and computer development, has become an integral part of everyday life. Millions of people may perform transaction through internet, mobile phone, ATM, and send e-mails, handle word processing or spreadsheets for different purposes. In another word, the network and information have been related to our daily life completely. Then, by IT advancing, the awareness of software security becomes a hot and serious topic. This paper will give some comments in various aspects, such as, in the beginning of the SDLC (System Development Life Cycle), how do designers analyze the functional and non-functional requirements and choose the proper development model? And then the testing professors take which kinds of methods to test the software with white-box testing or black-box testing to discover the vulnerabilities and flaws. At the same time, the paper gives some examples to demonstrate why the security of software is pretty important and what we should do to secure that. In addition, the paper will talk something about the enterprises’ actions to build a more secure network environment.

Mobile Software Assurance Informed through Knowledge Graph Construction: The OWASP Threat of Insecure Data Storage

Many organizations,to save costs,are moving to the Bring Your Own Mobile Device(BYOD)model and adopting applications built by third-parties at an unprecedented rate.Our research examines software assurance methodologies specifically focusing on security analysis coverage of the program analysis for mobile malware detection,mitigation,and prevention.This research focuses on secure software development of Android applications by developing knowledge graphs for threats reported by the Open Web Application Security Project(OWASP).OWASP maintains lists of the top ten security threats to web and mobile applications.We develop knowledge graphs based on the two most recent top ten threat years and show how the knowledge graph relationships can be discovered in mobile application source code.We analyze 200+healthcare applications from GitHub to gain an understanding of their software assurance of their developed software for one of the OWASP top ten mobile threats,the threat of“Insecure Data Storage.”We find that many of the applications are storing personally identifying information(PII)in potentially vulnerable places leaving users exposed to higher risks for the loss of their sensitive data.

AN ALGORITHM FOR AUTOMATICALLY GENERATING BLACK-BOX TEST CASES

Selection of test cases plays a key role in improving testing efficiency. Black-box testing is an important way of testing, and its validity lies on the selection of test cases in some sense. A reasonable and effective method about the selection and generation of test cases is urgently needed. This letter first introduces some usualmethods on black-box test case generation,then proposes a new algorithm based on interface parameters and discusses its properties, finally shows the effectiveness of the algorithm.

Comparison of SETAM with Security Use Case and Security Misuse Case:A Software Security Testing Study

A software security testing behavior model,SETAM,was proposed in our previous work as the integrated model for describing software security testing requirements behavior,which is not only compatible with security functions and latent typical misuse behaviors,but also with the interaction of them.In this paper,we analyze the differences between SETAM with security use case and security misuse case in different types of security test requirements.To illustrate the effectiveness of SETAM,we compare them in a practical case study by the number of test cases and the number of faults detected by them.The results show that SETAM could decrease about 34.87% use cases on average,and the number of faults detected by SETAM increased by 71.67% in average,which means that our model can detect more faults with fewer test cases for software security testing.

An Integration Testing Framework and Evaluation Metric for Vulnerability Mining Methods

Software an important way to vulnerability mining is detect whether there are some loopholes existing in the software, and also is an important way to ensure the secu- rity of information systems. With the rapid development of information technology and software industry, most of the software has not been rigorously tested before being put in use, so that the hidden vulnerabilities in software will be exploited by the attackers. Therefore, it is of great significance for us to actively de- tect the software vulnerabilities in the security maintenance of information systems. In this paper, we firstly studied some of the common- ly used vulnerability detection methods and detection tools, and analyzed the advantages and disadvantages of each method in different scenarios. Secondly, we designed a set of eval- uation criteria for different mining methods in the loopholes evaluation. Thirdly, we also proposed and designed an integration testing framework, on which we can test the typical static analysis methods and dynamic mining methods as well as make the comparison, so that we can obtain an intuitive comparative analysis for the experimental results. Final- ly, we reported the experimental analysis to verify the feasibility and effectiveness of the proposed evaluation method and the testingframework, with the results showing that the final test results will serve as a form of guid- ance to aid the selection of the most appropri- ate and effective method or tools in vulnera- bility detection activity.

MSMAM:Testing Resources Allocation,Obtaining Non-Functional Indexes Based on Functional Testing Results,and Evaluating Security

Security testing is a key technology for software security.The testing results can reflect the relationship between software testing and software security,and they can help program designers for evaluating and improving software security.However,it is difficult to describe by mathematics the relationship between the results of software functional testing and software nonfunctional security indexes.In this paper,we propose a mathematics model（MSMAM） based on principal component analysis and multiattribute utility theory.This model can get nonfunctional security indexes by analyzing quantized results of functional tests.It can also evaluate software security and guide the effective allocation of testing resources in the process of software testing.The feasibility and effectiveness of MSMAM is verified by experiments.

Structured Query Language Injection Penetration Test Case Generation Based on Formal Description

Aiming to improve the Structured Query Language( SQL) injection penetration test accuracy through the formalismguided test case generation,an attack purpose based attack tree model of SQL injection is proposed,and then under the guidance of this model, the formal descriptions for the SQL injection vulnerability feature and SQL injection attack inputs are established. Moreover,according to new coverage criteria,these models are instantiated and the executable test cases are generated.Experiments show that compared with the random enumerated test case used in other works,the test case generated by our method can detect the SQL injection vulnerability more effectively. Therefore,the false negative is reduced and the test accuracy is improved.

IKEChecker:语法引导的IKE协议有状态模糊测试

互联网密钥交换(IKE,internet key exchange)协议用于在IPSec(internet protocol security)协议中进行身份验证和密钥协商,其安全性对保护IP通信至关重要,复杂的协议逻辑导致协议实现中难免存在安全漏洞。模糊测试是检测协议实现中潜在漏洞的有效手段,但将现有模糊测试工具直接应用于IKE协议时,存在生成测试用例质量不高、难以探索深层状态空间等局限性。针对上述问题,设计了基于IKE协议语法的变异策略来减少无效测试用例的生成,同时增加测试用例的多样性;引入了基于进化策略的变异调度方案来自动优化变异算子的概率分布,进一步提高生成高质量测试用例的概率;设计了消息处理器用来维护协议交互上下文信息并执行密码学相关的操作,从而支持在黑盒条件下对IKE协议进行测试,并实现对深层协议交互行为和状态空间的探索。基于上述方法实现了IKE协议有状态模糊测试工具IKEChecker,该工具支持对IKEv1和IKEv2协议进行测试。对两种广泛使用的支持IKE协议实现的开源软件strongSwan和Libreswan进行测试,发现4个未公开漏洞;通过与其他模糊测试工具对比,评估了IKEChecker在漏洞检测方面的效率。

针对Android应用组件间通信的模糊测试技术研究

Intent是Android应用中最常用的组件间相互通信的载体。然而,如果应用组件对Intent处理不当,极有可能导致应用异常甚至崩溃。以Android应用的各个组件为研究对象,提出了一种通过构造Intent对象来测试Android应用组件间通信健壮性的模糊测试方法。首先分析应用组件的注册文件,提取需要测试的组件及其相关信息。然后,反编译APK源文件,获得目标组件的源代码并提取Intent的附加信息。接着,基于状态压缩批量生成目标组件的Intent测试用例用于自动化测试,并监控目标组件的运行日志来获取其运行状态反馈,据此判断应用组件在响应Intent时是否发生异常。最后,基于相似度匹配的错误日志去重算法,准确地将同一缺陷生成的错误日志归为一类,降低人工分析的工作量。实验表明,所提方法相较于现有前沿研究Hwacha,能够少生成9%的测试用例,多发现14%的程序异常,并通过去重算法显著降低了需要人工研判错误类别的工作量。

汽车软件OTA升级威胁分析及实测举隅

软件定义汽车是新一代汽车产业发展的必然趋势,汽车软件OTA升级是未来汽车软件升级的重要手段,在其带来便利的同时信息安全性值得重点关注。本文对汽车软件OTA升级进行资产识别、威胁场景识别、攻击路径及攻击可行性分析,提出汽车软件OTA升级信息安全测试指标,开展测试实践。本文给出测试过程中的重点问题分析,旨在通过完整的威胁分析,为汽车软件OTA升级体系研究提供参考。

基于本体的软件安全漏洞模式

针对软件缺陷与软件安全漏洞研究中存在的概念混淆问题,对DevSecOps框架下的软件安全漏洞生存期进行研究。基于软件安全漏洞生存期引入漏洞的4种情况,结合漏洞的特点提出软件安全漏洞模式定义,并采用本体方法进行表示。本体是概念化明确的规范说明,能够解决软件安全漏洞研究领域存在的二义性、不一致性、难以共享,以及由分析知识分散所导致的对人员知识和经验过度依赖的问题。以软件安全漏洞模式的分析为基础,兼顾宏观事件表现,构造漏洞分析的3层模型,即事件表示层、行为动作层和漏洞技术层。实例应用所构模型的层次结构实施渗透测试,包括安全风险分析、威胁建模、漏洞分析及渗透攻击等。实验结果表明:基于所提软件安全漏洞模式本体库的改进渗透测试具有科学性和有效性。

城市固废焚烧智能算法测试与验证模块化半实物平台

城市固废焚烧(Municipal solid waste incineration,MSWI)过程因工业现场的安全要求和控制系统的封闭特性导致离线研究的各类智能算法难以在线验证.此外,已有的实验室仿真平台难以模拟领域专家基于多模态数据进行智能感知、认知、决策和控制的工业实际.针对上述问题,首先,在综述现有面向工业过程的仿真平台研究现状和所面临挑战的基础上,描述面向MSWI过程智能算法测试与验证平台的需求,提出并构建由多模态历史数据驱动系统、安全隔离与优化控制系统和多入多出回路控制系统组成的模块化半实物平台.然后,在实验室环境中完成平台硬件搭建、工业软件开发、仿真功能实现和典型场景验证,并移植部分模块至工业现场进行应用.最后,总结与展望模块化半实物平台的研究方向.

嵌入式软件安全性测试研究

安全性测试作为一种常见的测试类型,在嵌入式软件测试中发挥着重要作用,可以有效保证嵌入式软件稳定、安全运行。本文对常见的安全性测试要点和测试方法进行研究和介绍,为软件开发人员和测试人员提供参考。

Fuzzing:Progress,Challenges,and Perspectives

As one of the most effective techniques for finding software vulnerabilities,fuzzing has become a hot topic in software security.It feeds potentially syntactically or semantically malformed test data to a target program to mine vulnerabilities and crash the system.In recent years,considerable efforts have been dedicated by researchers and practitioners towards improving fuzzing,so there aremore and more methods and forms,whichmake it difficult to have a comprehensive understanding of the technique.This paper conducts a thorough survey of fuzzing,focusing on its general process,classification,common application scenarios,and some state-of-the-art techniques that have been introduced to improve its performance.Finally,this paper puts forward key research challenges and proposes possible future research directions that may provide new insights for researchers.

DevSecOps中软件安全性测试技术综述

软件安全性测试技术是互联网时代软件开发商完善软件性能和抵御网络攻击的重要手段,而将安全性(Security)融入开发(Development)和运维(Operations)过程中的理念DevSecOps作为新一代软件开发模式,能够识别软件可能存在的威胁和有效评估软件安全性,可将软件安全风险置于可控范围内。于是,以DevOps(Development and Operations)流程为研究起点,梳理DevOps软件开发模式各阶段涉及的软件安全性测试技术,包括源代码审计、模糊测试、漏洞扫描、渗透测试和安全众测技术;收集和分析SCI、EI、SCOPUS、CNKI、CSCD和万方等知名索引库中近三年的相关文献资料,归纳总结以上技术的研究现状,并给出相关测试工具的使用建议;同时针对各技术支撑手段的优缺点,对软件开发模式DevSecOps的未来发展方向进行了展望。

基于Fuzzing测试的全新网络安全监测系统设计

该文提出了一种基于Fuzzing测试的全新网络安全监测系统设计方案。该系统将Fuzzing测试技术与其他先进算法结合,旨在实时监测网络范围内的用户行为、系统参数等关键信息,及时发现并应对潜在的安全威胁。通过阐述系统的硬件和软件设计,包括监测器、数据处理器、报警器以及各个软件模块的功能与实现方式,展示了该系统的全面性和高效性,以及网络安全监测的准确性和效率,为网络安全领域提供了一种新的防御策略。

自动驾驶系统模糊测试技术综述

自动驾驶是未来汽车产业发展趋势,然而自动驾驶车辆严重依赖于控制其运行的互连系统和软件,系统软件漏洞导致车辆面临严峻的安全隐患.自动驾驶安全测试能够提升汽车安全性,是保障汽车安全上路的重要环节.模糊测试(fuzz testing)作为一种自动化的漏洞测试技术,在面对复杂的软件系统时展现出卓越的漏洞探索能力.针对目前广泛使用的开源模糊测试工具进行了系统的归纳梳理,并通过对自动驾驶系统特性的深入分析,总结了当前研究面临的主要挑战,包括:1)难以全面考虑输入维度;2)多功能协同并发问题难以解决;3)安全问题类别不适配.为应对这些挑战提出了相应的参考建议,为未来相关研究提供了指导方向.

BBFuzz:一种基于输入结构感知的协议模糊测试方案

几乎所有需要通信的系统都离不开协议的设计,若协议栈存在漏洞,攻击者可以通过Zero-Click的方式达成拒绝服务攻击、信息窃取甚至是远程代码执行.协议消息具有一定的结构、语义、时序等要素,通用型模糊测试工具很难有效地对服务端进行模糊测试.近年来,有不少灰盒协议模糊测试的研究工作,其中比较具有代表性的工作是AFLNET,然而这些研究工作对服务端状态机的覆盖依赖于初始种子集的覆盖面.本文首先分析了AFLNET无法完善处理二进制格式协议的缺陷,并提出了BBFuzz,一款基于人工编写的数据模型进行测试用例生成的协议模糊测试工具.BBFuzz能够在仅有一个初始输入的情况下,快速为种子队列提供众多感兴趣的种子文件,并且这些种子文件能够覆盖到较为全面的服务端状态.同时,BBFuzz能够很好地支持两种不同类型的协议的模糊测试,即人类可读的ASCII格式和二进制格式的协议.本文实现了BBFuzz对RTMP协议的支持,并在两款知名的流媒体软件的RTMP模块上评估BBFuzz.评估结果表明,BBFuzz在map density和paths上的表现都优于AFLNET.对于RTMP模块,本文在ZLMediaKit和media-server上分别挖掘到一个真实的漏洞,并且这两个漏洞都已经被分配了HIGH级别的CVE编号.

嵌入式软件安全性测试技术方法分析

本文以嵌入式软件安全性测试技术方法为重点展开分析,对嵌入式软件发展历程和特点进行简述,在此基础上研究其安全性测试的要求、方法,包括故障模型分析法、故障树分析法等。以故障模型分析法为例,就嵌入式软件安全性测试的流程进行论述,分析系统功能描述和定位、潜在安全问题评估、安全问题破坏性评估、风险监控等重点环节实践方式,为未来嵌入式软件安全性测试工作提供参考。

基于神经机器翻译的测试用例协同演化方法研究

软件测试在软件安全保障和质量保证流程中扮演着关键角色,为了降低软件的维护成本,提高软件的安全性,需要尽早地发现和修复漏洞和问题。因此在软件版本迭代的过程中,测试代码需要在生产代码修改后及时更新。然而,测试代码往往难以和生产代码同步更新,导致测试效果不佳。协同演化方法被用于解决这一问题,但维持这一模式的成本较高。本文分析了现有研究,利用关联规则挖掘技术,研究了生产代码和测试代码之间的协同演化关系,提出了一种基于神经机器翻译(Neural Machine Translation,NMT)的测试用例协同演化方法(NMT-based Test Case Co-evolution,NTCC)。通过分析生产代码和测试代码的历史提交来提取测试用例的特征,在历史提交的生产代码和测试上进行训练,然后在一个较小的生产代码数据集上进行调整,最后通过集束搜索的方法产生测试代码。实验结果表明,NTCC方法可以有效地识别生产-测试代码协同演化,准确率达到了78.33%,在正类和负类上的F1-分数分别为80.10%和76.22%,优于基线方法。