loading...
Monitoring the Security Health of Software Systems
Raleigh, North Carolina November 07-November 10
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ISSRE.2006.3217th International Symposium on Softw ...
 This Article 
 
PDF
HTML
 
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
Ashish Aggarwal, Indian Institute of Technology(IIT), India
Pankaj Jalote, Indian Institute of Technology(IIT), India
Detecting security bugs during the development cycle of a software is extremely difficult as effective testing approaches for such bugs do not exist. Applications are often deployed without being tested for security vulnerabilities even though the application domain demands highly secure software. Hence there is a need to develop systems which can monitor such applications for security violations and take immediate actions if any violation occurs. In this paper we describe an approach for monitoring the security health of a software system. Our methodology involves an agent based approach which communicates with the health monitoring system running as an independent process. We make this agent a part of the application(binary) and modify the binary at appropriate locations to transfer the control to the agent attached. The agent sends critical information regarding the execution to the monitoring system. The monitoring system analyzes the data and takes suitable actions. Currently our system monitors the following security bugs - buffer overflow, race conditions( Time of Check to Time to Use vulnerability), random number vulnerability and can be extended for other vulnerabilities also.
Citation:
Ashish Aggarwal, Pankaj Jalote, "Monitoring the Security Health of Software Systems," issre, pp.146-158, 17th International Symposium on Software Reliability Engineering (ISSRE'06), 2006
Usage of this product signifies your acceptance of the Terms of Use.