Vulnerability Coverage for Secure Configuration
Shuvalaxmi Dass, Akbar Siami Namin

TL;DR
This paper introduces vulnerability coverage as a new adequacy testing approach that uses evolutionary algorithms and CVSS scores to identify security vulnerabilities in software, enhancing testing thoroughness.
Contribution
It proposes a novel vulnerability coverage measure and adapts genetic algorithms and particle swarm optimization for effective vulnerability testing.
Findings
Uses CVSS as a fitness measure for test input generation
Employs evolutionary algorithms to identify vulnerability patterns
Enhances software security testing coverage
Abstract
We present a novel idea on adequacy testing called ``{vulnerability coverage}.'' The introduced coverage measure examines the underlying software for the presence of certain classes of vulnerabilities often found in the National Vulnerability Database (NVD) website. The thoroughness of the test input generation procedure is performed through the adaptation of evolutionary algorithms namely Genetic Algorithms (GA) and Particle Swarm Optimization (PSO). The methodology utilizes the Common Vulnerability Scoring System (CVSS), a free and open industry standard for assessing the severity of computer system security vulnerabilities, as a fitness measure for test inputs generation. The outcomes of these evolutionary algorithms are then evaluated in order to identify the vulnerabilities that match a class of vulnerability patterns for testing purposes.
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Testing and Debugging Techniques · Software Reliability and Analysis Research · Advanced Malware Detection Techniques
