.png){kind=icon}
返回
Detecting Software Security Vulnerabilities Via Requirements Dependency Analysis
.png){kind=icon}
OA
AI
DOI：10.1109/TSE.2020.3030745.png)
.png){kind=icon}
.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Cyber attacks targeting software applications have a tremendous impact on our daily life. For example, attackers have utilized vulnerabilities of web applications to steal and gain unauthorized use of sensitive data stored in these systems. Previous studies indicate that security testing is highly precise, and therefore is widely applied to validate individual security requirements. However, dependencies between security requirements may cause additional vulnerabilities. Manual dependency detection faces scalability challenges, e.g., a previous study shows that the pairwise dependency analysis of 40 requirements would take around 12 hours. In this article, we present a novel approach which integrates the interdependency among high-level security requirements, such as those documented in policies, regulations, and standards. We then use automated requirements tracing methods to identify product-level security requirements and their dependencies. Our manual analysis of HIPAA and FIPS 200 leads to the identification of five types of high-level security requirements dependencies, which further inform the automated tracing methods and guide the designs of system-level security tests. Experimental results on five projects in healthcare and education domains show the significant recall improvements at 81 percent. Our case study on a deployed production system uncovers four previously unknown vulnerabilities by using the detected requirements dependencies as test paths, demonstrating our approach's value in connecting requirements engineering with security testing.
Keyword:
Security
Software
Testing
Manuals
Static analysis
Regulation
Scalability
Security requirements
requirements dependency management
requirements traceability
vulnerability discovery
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
IF:
5.6
论文数:
2.8K
被引数:
1.1W
机构
引用论文
Enhanced electrochemical heavy metal ion sensor using liquid metal marbles - towards on-chip application.png)
COMMAD 2012
COMMAD 2012IF0
PREAI
分享收藏Formation of coronene:water complexes: FTIR study in argon matrices and theoretical characterisation
PREAI
分享收藏
查看更多内容