A model-based attack injection approach for security validation - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès SIN '11 : 4th international conference on Security of information and networks Année : 2011

A model-based attack injection approach for security validation

Résumé

Communication systems are inherently buggy. These flaws can lead to security breaches in applications, which a malicious user could exploit to cause security failures in the system and, under certain circumstances, to take complete control of the vulnerable system. In this paper, we introduce a novel attack injection approach based on attack modeling to perform security testing and detect potential security vulnerabilities. We use attack trees to describe the system flaws and derive corresponding attack scenarios. The attack scenarios are refined to executable scripts for testing tools that are in charge of injecting the attacks against the system. The approach is applied to the Wireless Application Protocol (WAP) currently used in low-tier mobile devices. We carried out experiments using real attacks such as Denial of Service (DoS) and Cipher Suite Rollback attacks. The experimental results show that the approach can achieve high efficiency in the role of uncovering vulnerabilities.
Fichier non déposé

Dates et versions

hal-00711762 , version 1 (25-06-2012)

Identifiants

Citer

Anderson Morais, Ana Rosa Cavalli, Eliane Martins. A model-based attack injection approach for security validation. SIN '11 : 4th international conference on Security of information and networks, Nov 2011, Sydney, Australia. pp.103-110, ⟨10.1145/2070425.2070443⟩. ⟨hal-00711762⟩
34 Consultations
0 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More