A Case Study of Software Security Test Based On Defects Threat Tree Modeling

摘要：

Due to the increasing complexity of software applications, traditional function security testing ways, which only test and validate software security mechanisms, are becoming ineffective to detect latent software security defects (SSD). However, the most of vulnerabilities result from some typical SSD. According to CERT/CC, ten defects known are responsible for 75％ of security breaches in today software applications. On the base of threat tree modeling, we use it in the integrated software security test model. For introducing the usefulness of the method, we use the test model in M3TR software security test.

关键词： software security testing security defects threat tree

作者: Song Huang ZhanWei Hui Liang Wang XiaoMing Liu

作者单位: PLA University of Science and Technology (PLAUST) PLA Software Test and Evaluation Center for Milita Institute of Command and Automation PLA University of Science and Technology Nanjing, China

会议类型: 国际会议

会议名称: 2010年IEEE多媒体信息网络与安全国际会议

会议地点: 南京

会议语种:英文

页码: 362-365

在线出版日期: 2010-11-01（万方平台首次上网日期，不代表论文的发表时间）