Software Security Testing Based on Threat Model
Shi Yin-sheng · Computers & Security · 2010
Security testing focuses on negative requirements while most traditional software testing deals with positive requirements. Security testing based on threat model is from the adversary’s perspective. Threats to security policies are modeled with UML (Unified Modeling Language) sequence diagrams. The message sequences can derived from the threat models, and the threat traces can derived from the message sequences. When the code becomes baseline, it can be instrumented using the threat model as a guide, so as to record the trace of threat related method calling and method execution at runtime. The instrumented code is executed using test cases generated on design model. The execution traces are collected and analyzed to verify whether the execution traces are matched with the threat traces. If an execution trace matches a threat trace, a message will be produced to report the violation of security policies.