A mining approach for component abnormal information based on monitor log. (2016)

• Record Type: Journal Article
• Authors: Chen, Jinfu; Zhu, Lili; Guo, Yuchi; Cai, Saihua; Zhao, Xiaolei
• Is Part Of: International journal of simulation and process modelling. Volume 11:Number 5(2016)
• Page Start: 353
• Page End: 362
• Publication Date: 2016
• Subjects: component testing -- explicit vulnerability -- implicit vulnerability -- apriori algorithm -- GSP algorithm -- software components -- data mining -- abnormal information -- monitor logs -- security vulnerabilities -- software security -- frequent item sets -- generalised sequential patterns; Management -- Computer simulation -- Periodicals; Mathematical models -- Periodicals; Operations research -- Periodicals; Simulation methods -- Periodicals; 003.05
• Languages: English
• ISSNs: 1740-2123

Abstract

A software component is an assembly unit that can be deployed independently in any software system. Since the source code and development documents of software components cannot be obtained, the vulnerability testing for software components is a challenge for component users. Explicit and implicit vulnerabilities are two common security vulnerabilities in the components. In this paper, in order to detect security vulnerabilities in the component under test effectively, a mining approach for component abnormal information based on monitor log is proposed. For explicit vulnerability, the monitor log is mined with the improved apriori algorithm, and the risk coefficient of each method in component is calculated with the frequent item sets algorithm based on the mining results. For implicit vulnerability, all the method execution sequences in monitor log should be extracted and stored into a database to establish the method sequence database. The vulnerability testing report will be obtained by mining the method sequence database with the improved generalised sequential patterns (GSP) algorithm after data preprocessing. An empirical study based on the proposed method is conducted, and the experimental results show that the approach to mine component abnormal information can effectively detect security exceptions of the component under test.