Attack scripts generation for security validation - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2010

Attack scripts generation for security validation

Résumé

In this paper we present an original approach to generate attack scripts aiming at security validation of information systems and applications. The goal is to uncover potential vulnerabilities that an attacker could exploit to cause security failures of the system. We use attack modelling to specify the system flaws and derive the corresponding attack scenarios. The attack scenarios are refined to generic attack scripts using: attack pattern, event- condition-action rule, keyword-driven testing, and UML diagrams. The generic attack scripts are then converted to executable scripts for a testing tool. The generated attack scripts are in a format that is independent of the used tool, i.e., they are reusable. The executable attack scripts are able to simulated real attacks. Examples are provided to show the usage of the approach
Fichier non déposé

Dates et versions

hal-00727714 , version 1 (04-09-2012)

Identifiants

  • HAL Id : hal-00727714 , version 1

Citer

Anderson Morais, Ana Rosa Cavalli, Eliane Martins. Attack scripts generation for security validation. SEC-SY '10 : Sécurité des Systèmes d'Information et les Environnements Collaboratifs, May 2010, Marseille, France. ⟨hal-00727714⟩
41 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More