Linguistic security testing for text communication protocols. (25th January 2012)

• Record Type: Journal Article
• Authors: Kam, Ben W.Y.; Dean, Thomas R.
• Other Names: Simons Anthony JH guestEditor.; Fraser Gordon guestEditor.; Bottaci Leonardo guestEditor.
• Is Part Of: Software, practice & experience. Volume 43:Number 9(2013)
• Page Start: 1103
• Page End: 1120
• Publication Date: 2012-01-25
• Subjects: security testing, mutation testing, text‐based communication protocol; Computer software -- Periodicals; Computer programming -- Periodicals; Computer programs -- Periodicals; 005.3
• DOI: 10.1002/spe.2108
• Languages: English
• ISSNs: 0038-0644

Abstract

SUMMARY: We introduce a new Syntax‐based Security Testing framework that uses a protocol specification to perform security testing on text‐based communication protocols. A protocol specification of a particular text‐based protocol under test represents its syntactic grammar and static constraints. The specification is used to generate test cases by mutating valid messages, breaking the syntax and constraints of the protocol. The framework is demonstrated using a toy web application and the open source application KOrganizer. Copyright © 2012 John Wiley & Sons, Ltd.