摘要
Web应用程序由于其自身的特点和实现方式,在面对恶意攻击时,显得十分脆弱。为了提高Web应用系统的安全性,需要针对它的特点设计合理有效的测试方法。提出一种方法,采用扩展的有限状态机模型针对Web应用可能存在安全漏洞的模块进行形式化的分析建模,生成威胁模型并从中解析出抽象的安全测试用例。结合常见的Web应用安全攻击方式中基于语法的攻击输入数据,将抽象的安全测试用例实例化为实现级别的可执行的安全测试用例。设计开发了一个原型工具,以一个Web购物网站为待测系统,在实验中验证了该方法的可行性和有效性。
Due to the characteristics and implementation of its own,Web application is very fragile when getting malicious attacks. In order to improve the security of Web application,it is necessary to design reasonable and effective test method based on its characteristics. This paper proposed a method to model the possible vulnerabilities of Web applications by using the extended finite state machine model to generate a threat model and analyze the abstract security test cases. By combining the test data generated based on the syntax,the abstract security test cases were converted into executable security test cases of implement level. According to the article content design,we developed a prototype tool.Taking a Web shopping site as the system under test,the feasibility and effectiveness of the method were verified in the experiment.
出处
《计算机应用与软件》
北大核心
2018年第2期30-35,101,共7页
Computer Applications and Software
