II-NEW: Infrastructure for model-based security testing, controlled experiments, and education

North Dakota State University Fargo, Fargo ND

Investigators

Abstract

This project focuses on building a test bed that will enable scalable and automated security testing of applications. Software secure design and security testing techniques are fundamental to the development of secure software. Many of the properties, strengths, and limitations of these techniques, however, can be fully understood only through rigorous, controlled experiments. This project addresses these challenges. The overall objective is to help engineers create dependable secure systems. To do this, this project engages in the following research and development activities: -Development of test generation tools that consist of three components: a model-based security test sequence generator that generates tests automatically from a secure design considering two design-level models ? security and threat models; an executable test code generator that converts security tests derived from security and threat models to test code that can be executed together with the implementation under test; a test input generator that generates actual inputs to complete test cases using a syntax-based testing approach. -Development of the testbed that includes various software artifacts and test automation tools to support controlled experiments with security testing. Several tangible results from this work are expected. The success of this project may open a new avenue to automated testing for security, which can improve security assurance while significantly reducing the overall development costs of secure systems. In particular, this work may make it possible to develop many new strategies for generating security test code in terms of a rich variety of coverage criteria for secure design models. This will lay a foundation for evaluating scalability and cost-effectiveness (e.g., in terms of vulnerability detection capability and testing cost) of various security testing strategies. This project has several broad impacts: the proposed work will support several graduate and undergraduate students as they work toward their degree goals and provide them with experience with developing tools and empirical studies. Also, this proposal is focused on making the resulting infrastructure available to researchers and educators, enabling them to use tools and perform controlled experiments as well as train students. North Dakota is an EPSCOR state, thus, support for this project will help meet the goals of the EPSCoR program.