Paper published in a book (Scientific congresses, symposiums and conference proceedings)
SOFIA: An Automated Security Oracle for Black-Box Testing of SQL-Injection Vulnerabilities
Ceccato, Mariano; Nguyen, Duy Cu; Appelt, Dennis et al.
2016In Proceedings of the 31th IEEE/ACM International Conference on Automated Software Engineering
Peer reviewed
 

Files


Full Text
main.pdf
Author preprint (279.73 kB)
Request a copy

All documents in ORBilu are protected by a user license.

Send to



Details



Keywords :
Web Application Security; Penetration Testing; Software Testing
Abstract :
[en] Security testing is a pivotal activity in engineering secure software. It consists of two phases: generating attack inputs to test the system, and assessing whether test executions expose any vulnerabilities. The latter phase is known as the security oracle problem. In this work, we present SOFIA, a Security Oracle for SQL-Injection Vulnerabilities. SOFIA is programming-language and source-code independent, and can be used with various attack generation tools. Moreover, because it does not rely on known attacks for learning, SOFIA is meant to also detect types of \sqli attacks that might be unknown at learning time. The oracle challenge is recast as a one-class classification problem where we learn to characterise legitimate SQL statements to accurately distinguish them from \sqli attack statements. We have carried out an experimental validation on six applications, among which two are large and widely-used. SOFIA was used to detect real \sqli vulnerabilities with inputs generated by three attack generation tools. The obtained results show that SOFIA is computationally fast and achieves a recall rate of 100\% (i.e., missing no attacks) with a low false positive rate (0.6\%).
Research center :
ULHPC - University of Luxembourg: High Performance Computing
Disciplines :
Computer science
Author, co-author :
Ceccato, Mariano;  Fondazione Bruno Kessler
Nguyen, Duy Cu ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Appelt, Dennis ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
Briand, Lionel ;  University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT)
External co-authors :
yes
Language :
English
Title :
SOFIA: An Automated Security Oracle for Black-Box Testing of SQL-Injection Vulnerabilities
Publication date :
2016
Event name :
31st IEEE/ACM International Conference on Automated Software Engineering (ASE 2016)
Event date :
from 05-09-2016 to 07-09-2016
Audience :
International
Main work title :
Proceedings of the 31th IEEE/ACM International Conference on Automated Software Engineering
Peer reviewed :
Peer reviewed
Focus Area :
Security, Reliability and Trust
FnR Project :
FNR4800382 - Black-box Security Testing For Web Applications And Services, 2012 (01/10/2012-30/06/2016) - Dennis Appelt
Funders :
FNR - Fonds National de la Recherche [LU]
FBK Mobility project
Available on ORBilu :
since 11 August 2016

Statistics


Number of views
267 (31 by Unilu)
Number of downloads
10 (10 by Unilu)

Scopus citations®
 
26
Scopus citations®
without self-citations
25

Bibliography


Similar publications



Contact ORBilu