基于安全规则变异的Web Services安全性测试方法

发布时间：2018-04-13 16:25

本文选题：Web + Services　；参考：《计算机学报》2013年10期

【摘要】：针对已有变异测试研究中仅考虑对SOAP(Simple Object Access Protocol)消息输入参数的变异处理,而缺乏对SOAP消息安全规则变异的研究,文中从消息机密性、完整性及身份认证等方面对安全规则进行归类,提出了一种基于安全规则变异的Web Services安全性测试方法.首先给出一种安全规则变异测试框架,研究变异点判定规则库,设计出相应的变异操作算子、漏洞判定准则以及基于优先级与权重策略的变异算子选择方法.然后提出一种基于安全规则变异的测试用例生成算法,依照算法生成违背安全规则的SOAP消息,从而揭露Web Services的安全类故障.最后实现了一个Web Services安全性测试工具WSSTT(Web Services Security Testing Tool),在工具的基础上进行实验和对比分析,验证了文中提出的基于安全规则变异的Web Services安全测试方法的可行性和有效性.
[Abstract]:In view of the fact that only the mutation processing of SOAP(Simple Object Access protocol message input parameters is considered in the existing mutation test research, but the research on SOAP message security rule mutation is lacking, this paper starts from the message confidentiality.Security rules are classified in integrity and identity authentication, and a Web Services security test method based on security rule mutation is proposed.Firstly, a security rule mutation testing framework is presented, and the mutation point rule base is studied, and the corresponding mutation operator, loophole decision criterion and mutation operator selection method based on priority and weight strategy are designed.Then, a test case generation algorithm based on security rule mutation is proposed, according to which the SOAP messages that violate the security rules are generated, thus exposing the security class fault of Web Services.Finally, a Web Services security testing tool, WSSTT(Web Services Security Testing tool, is implemented. Experiments and comparative analysis are carried out on the basis of the tools, and the feasibility and effectiveness of the proposed Web Services security test method based on security rule mutation are verified.
【作者单位】：江苏大学计算机科学与通信工程学院;斯文本科技大学信息和通信技术学院;江西财经大学软件与通信工程学院;华中科技大学计算机科学与技术学院;
【基金】：国家自然科学基金(61202110,61063013) 教育部博士点专项基金(20103227120005) 江苏省自然科学基金(BK2012284)资助~~
【分类号】：TP393.09

【参考文献】