Developing a Testing Framework for Security

Despite increasing efforts in detecting and managing software security flaws, the number of security attacks is still rising every year [5, 21]. As software becomes more complex, security flaws are more easily introduced into a system and more difficult to eliminate. Meanwhile, attackers take advantage of software tools for developing, testing and debugging exploits, which make the construction of attacks automatic, fast and easy [20]. There have been many approaches to the challenges of managing security flaws, including solutions that monitor and protect systems after software is deployed, e.g., intrusion detection and runtime monitoring. These tools are all reactive, in that they detect vulnerabilities when attacks occur. Simply rebooting for recovery may lead to denial of service for the software system. A safer approach is patching software, which is expensive and needs to be done faster than the spread of the malware. There have also been efforts to detect and eliminate security flaws before software release, including static analysis, model checking and testing approaches. The challenge for static tools is the balance between precision and scalability since either superfluous false positives or high overhead will make tools useless in practice. Testing for security flaws has not received much research attention. Existing approaches include random-testing based Fuzz and instrumentation based buffer overflow testing [10, 12]. However, they both report low coverage of the code. Manual penetration testing is still widely used, but it is not scalable. Testing for correctness of the software detects inconsistencies between software behavior and functional specification or by crashing the program. Similarly, testing could be used to detect security flaws by demonstrating inconsistencies between software behavior and security policies or symptoms of violating security coding rules. After all, security flaws are a special type of design or coding flaws. Testing can play an important part in producing software systems that are secure just as it plays a major role in helping to guarantee the correctness of programs. Despite the similarity between security flaws and flaws that prevent programs from functioning correctly, security flaws have the feature of being hard to detect after being implanted into programs, making it impossible to check them with traditional correctness-checking tools. Applying existing testing techniques to check for security violations involves several challenges. Firstly, according to the cause of the vulnerabilities, security flaws are often located at exceptional control flow branches, triggered only when a boundary condition is satisfied (e.g., flaws cause integer overflow) and exposed only by a very special input. It is difficult to model vulnerabilities that describe these control and data conditions properly. Finite state machines, formal specifications, coding signatures or their combination are candidates for representing these conditions. Secondly, in order to check programs against vulnerabilities efficiently, an intermediate representation of the program that represents security control and data flow of certain types of vulnerability needs to be developed. The third difficulty is to determine the environmental factors that trigger vulnerabilities and the ways to simulate them in testing. The goal of this research project is to develop a testing framework for detecting and managing security flaws. The key idea is to develop static analysis tools to determine program paths that lead to various types of vulnerabilities, and then apply testing techniques to exploit the vulnerabilities. The static analysis algorithms will be path-sensitive to provide detailed information about the security flaw. They will also be demand-driven to ensure scalability to handle large programs. Test inputs will be automatically generated to exercise potentially vulnerable paths and paths where a determination of whether vulnerability exists cannot be made statically to try to demonstrate vulnerability. By demonstrating real exploits through testing, we aim to eliminate (or at least reduce) false alarms generated from static analysis. We plan to consider several popular vulnerabilities: memory safety, denial of service caused by exhausted resources, privilege escalation and resource access control violations [5, 18, 21].