Moth: a hybrid threat model for improving software security testing
As SQL injection attack (SQLIA) continues to threaten web applications despite several techniques recommended to prevent it, a Hybrid Threat Modeling strategy was adopted in this research due to its proactive approach to risk mitigation in web applications. This involved the combination of 3 thre...
| Main Author: | |
|---|---|
| Format: | Thesis |
| Language: | English English English |
| Published: |
2018
|
| Subjects: | |
| Online Access: | http://eprints.uthm.edu.my/185/1/24p%20HABEEB%20OLADAPO%20OMOTUNDE.pdf http://eprints.uthm.edu.my/185/2/HABEEB%20OLADAPO%20OMOTUNDE%20COPYRIGHT%20DECLARATION.pdf http://eprints.uthm.edu.my/185/3/HABEEB%20OLADAPO%20OMOTUNDE%20WATERMARK.pdf |
| _version_ | 1796868221387669504 |
|---|---|
| author | Omotunde, Habeeb Oladapo |
| author_facet | Omotunde, Habeeb Oladapo |
| author_sort | Omotunde, Habeeb Oladapo |
| collection | UTHM |
| description | As SQL injection attack (SQLIA) continues to threaten web applications despite
several techniques recommended to prevent it, a Hybrid Threat Modeling strategy
was adopted in this research due to its proactive approach to risk mitigation in web
applications. This involved the combination of 3 threat modeling techniques namely
misuse cases, attack trees and finite state machines in order to harness their individual
strengths to design a Hybrid Threat Modeling framework and tool called MOTH
(Modeling Threats using Hybrid techniques). Using the MOTH tool developed using
Eclipse rich client platform, experimental results with an e-commerce web application
downloaded from GitHub namely BodgeIt store shows an improved SQL injection
vulnerability detection rate of 13.33% in comparison to a commercial tool, IBM
AppScan. Further benchmarking of MOTH with respect to SQL injection vulnerability
detection in both BodgeIT store and IBM’s Altoro Mutual online banking application
shows it is 30.6% more effective over AppScan. Relative to other threat modeling
tools, MOTH was able to realize a 41.7% optimization of attack paths required to
design effective test plans and test cases for the recommendation of efficient security
requirements needed to prevent SQL injection attacks. A 100% risk mitigation
was achieved after applying these recommendations due to a complete security test
coverage of all test cases during the experiment as all test cases successfully exposed
the inherent security mutants in the AUT. These results show that MOTH is a more
suitable hybrid threat modeling tool for preventing poor specifications that expose web
applications to SQL injection attacks. |
| first_indexed | 2024-03-05T21:36:35Z |
| format | Thesis |
| id | uthm.eprints-185 |
| institution | Universiti Tun Hussein Onn Malaysia |
| language | English English English |
| last_indexed | 2024-03-05T21:36:35Z |
| publishDate | 2018 |
| record_format | dspace |
| spelling | uthm.eprints-1852021-07-06T07:50:11Z http://eprints.uthm.edu.my/185/ Moth: a hybrid threat model for improving software security testing Omotunde, Habeeb Oladapo HV8290-8291 Private security services As SQL injection attack (SQLIA) continues to threaten web applications despite several techniques recommended to prevent it, a Hybrid Threat Modeling strategy was adopted in this research due to its proactive approach to risk mitigation in web applications. This involved the combination of 3 threat modeling techniques namely misuse cases, attack trees and finite state machines in order to harness their individual strengths to design a Hybrid Threat Modeling framework and tool called MOTH (Modeling Threats using Hybrid techniques). Using the MOTH tool developed using Eclipse rich client platform, experimental results with an e-commerce web application downloaded from GitHub namely BodgeIt store shows an improved SQL injection vulnerability detection rate of 13.33% in comparison to a commercial tool, IBM AppScan. Further benchmarking of MOTH with respect to SQL injection vulnerability detection in both BodgeIT store and IBM’s Altoro Mutual online banking application shows it is 30.6% more effective over AppScan. Relative to other threat modeling tools, MOTH was able to realize a 41.7% optimization of attack paths required to design effective test plans and test cases for the recommendation of efficient security requirements needed to prevent SQL injection attacks. A 100% risk mitigation was achieved after applying these recommendations due to a complete security test coverage of all test cases during the experiment as all test cases successfully exposed the inherent security mutants in the AUT. These results show that MOTH is a more suitable hybrid threat modeling tool for preventing poor specifications that expose web applications to SQL injection attacks. 2018-07 Thesis NonPeerReviewed text en http://eprints.uthm.edu.my/185/1/24p%20HABEEB%20OLADAPO%20OMOTUNDE.pdf text en http://eprints.uthm.edu.my/185/2/HABEEB%20OLADAPO%20OMOTUNDE%20COPYRIGHT%20DECLARATION.pdf text en http://eprints.uthm.edu.my/185/3/HABEEB%20OLADAPO%20OMOTUNDE%20WATERMARK.pdf Omotunde, Habeeb Oladapo (2018) Moth: a hybrid threat model for improving software security testing. Doctoral thesis, Universiti Tun Hussein Onn Malaysia. |
| spellingShingle | HV8290-8291 Private security services Omotunde, Habeeb Oladapo Moth: a hybrid threat model for improving software security testing |
| title | Moth: a hybrid threat model for improving software security testing |
| title_full | Moth: a hybrid threat model for improving software security testing |
| title_fullStr | Moth: a hybrid threat model for improving software security testing |
| title_full_unstemmed | Moth: a hybrid threat model for improving software security testing |
| title_short | Moth: a hybrid threat model for improving software security testing |
| title_sort | moth a hybrid threat model for improving software security testing |
| topic | HV8290-8291 Private security services |
| url | http://eprints.uthm.edu.my/185/1/24p%20HABEEB%20OLADAPO%20OMOTUNDE.pdf http://eprints.uthm.edu.my/185/2/HABEEB%20OLADAPO%20OMOTUNDE%20COPYRIGHT%20DECLARATION.pdf http://eprints.uthm.edu.my/185/3/HABEEB%20OLADAPO%20OMOTUNDE%20WATERMARK.pdf |
| work_keys_str_mv | AT omotundehabeeboladapo mothahybridthreatmodelforimprovingsoftwaresecuritytesting |