Security Testing of Code Components

Software testing is the key activity for finding defects in source code, consisting of developing several test cases that evaluate a test item with specific input data and observe whether the returned results match the expected ones. This activity is primarily used to find ordinary “functional” bugs; nevertheless, it can also be used to find vulnerabilities that threaten the security properties of a test item, i.e., evaluating the degree to which it is protected from unauthorized access and permits only authorized parties to access it. In this case, the activity is called (software) security testing. Several techniques fall under this umbrella, such as SAST, DAST, and Penetration Testing. Despite all being proven efficient at finding several types of vulnerabilities, they exhibit limitations that prevent them from covering all possible scenarios in which vulnerabilities arise. For instance, SAST over-approximates the code under test and neglects its actual behavior; at the same time, DAST and penetration testing often target the entire system and require deployment, which prevents their adoption at earlier stages. Such limitations could be addressed through more fine-grained testing, creating security-focused test cases targeting specific code components whose implementations might contain security flaws. This project, named SToCC (Security Testing of Code Components), aims to make a foundational scientific contribution to component-level security testing by characterizing the profile of security tests and by experimenting with automated approaches to generate and maintain them. Specifically, SToCC plans to analyze the profile (prevalence, anatomy, and dynamics) of component-level security tests in software projects and generate new tests to detect unknown vulnerabilities. Then, it plans to assess and enhance the oracles of existing component-level security tests and evaluate their responses when the targeted code components change. This is achieved through empirical studies and a design science approach. The foreseen impact of SToCC is to raise security researchers’ awareness of component-level security testing and to stimulate further research. At the same time, software engineers can build on the exploitable artifacts produced by SToCC to develop better tools to facilitate the development and maintenance of security tests.

Options