OpenSAW: Open Security Analysis Workbench

Noomene Ben Henda; Björn  Johansson; Patrik Lantz; Karl Norrman; Pasi  Saaranen; Oskar Segersvärd

doi:10.1007/978-3-662-54494-5

OpenSAW: Open Security Analysis Workbench

Noomene Ben Henda, Björn Johansson, Patrik Lantz, Karl Norrman, Pasi Saaranen, Oskar Segersvärd

Networks and Security

Research output: Chapter in Book/Report/Conference proceeding › Paper in conference proceeding › peer-review

Abstract

Software is today often composed of many sourced components, which potentially contain security vulnerabilities, and therefore require testing before being integrated. Tools for automated test case generation, for example, based on white-box fuzzing, are beneficial for this testing task. Such tools generally explore limitations of the specific underlying techniques for solving problems related to, for example, constraint solving, symbolic execution, search heuristics and execution trace extraction. In this article we describe the design of OpenSAW, a more flexible general-purpose white-box fuzzing framework intended to encourage research on new techniques identifying security problems. In addition, we have formalized two unaddressed technical aspects and devised new algorithms for these. The first relates to generalizing and combining different program exploration strategies, and the second relates to prioritizing execution traces. We have evaluated OpenSAW using both in-house and external programs and identified several bugs.

Original language	English
Title of host publication	Fundamental Approaches to Software Engineering
Subtitle of host publication	20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings
Editors	Marieke Huisman, Julia Rubin
Place of Publication	Berlin Heidelberg
Publisher	Springer
Pages	321-337
Number of pages	16
Volume	10202
Edition	1
ISBN (Electronic)	978-3-662-54494-5
ISBN (Print)	978-3-662-54493-8
DOIs	https://doi.org/10.1007/978-3-662-54494-5
Publication status	Published - 2017 Apr 22
Event	Fundamental Approaches to Software Engineering: 20th International Conference, FASE 2017 - Uppsala, Sweden Duration: 2017 Apr 22 → 2017 Apr 29 Conference number: 20 https://www.etaps.org/index.php/2017/fase

Conference

Conference	Fundamental Approaches to Software Engineering
Abbreviated title	FASE'17
Country/Territory	Sweden
City	Uppsala
Period	2017/04/22 → 2017/04/29
Internet address	https://www.etaps.org/index.php/2017/fase

Subject classification (UKÄ)

Computer Science

Access to Document

10.1007/978-3-662-54494-5

https://link.springer.com/chapter/10.1007/978-3-662-54494-5_18

Cite this

Ben Henda, N., Johansson, B., Lantz, P., Norrman, K., Saaranen, P., & Segersvärd, O. (2017). OpenSAW: Open Security Analysis Workbench. In M. Huisman, & J. Rubin (Eds.), Fundamental Approaches to Software Engineering: 20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings (1 ed., Vol. 10202, pp. 321-337). Springer. https://doi.org/10.1007/978-3-662-54494-5

Ben Henda, Noomene ; Johansson, Björn ; Lantz, Patrik et al. / OpenSAW: Open Security Analysis Workbench. Fundamental Approaches to Software Engineering: 20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings. editor / Marieke Huisman ; Julia Rubin. Vol. 10202 1. ed. Berlin Heidelberg : Springer, 2017. pp. 321-337

@inproceedings{e68b53753dfb48e8ab4137c05234488f,

title = "OpenSAW: Open Security Analysis Workbench",

abstract = "Software is today often composed of many sourced components, which potentially contain security vulnerabilities, and therefore require testing before being integrated. Tools for automated test case generation, for example, based on white-box fuzzing, are beneficial for this testing task. Such tools generally explore limitations of the specific underlying techniques for solving problems related to, for example, constraint solving, symbolic execution, search heuristics and execution trace extraction. In this article we describe the design of OpenSAW, a more flexible general-purpose white-box fuzzing framework intended to encourage research on new techniques identifying security problems. In addition, we have formalized two unaddressed technical aspects and devised new algorithms for these. The first relates to generalizing and combining different program exploration strategies, and the second relates to prioritizing execution traces. We have evaluated OpenSAW using both in-house and external programs and identified several bugs.",

author = "{Ben Henda}, Noomene and Bj{\"o}rn Johansson and Patrik Lantz and Karl Norrman and Pasi Saaranen and Oskar Segersv{\"a}rd",

year = "2017",

month = apr,

day = "22",

doi = "10.1007/978-3-662-54494-5",

language = "English",

isbn = "978-3-662-54493-8",

volume = "10202",

pages = "321--337",

editor = "Marieke Huisman and Julia Rubin",

booktitle = "Fundamental Approaches to Software Engineering",

publisher = "Springer",

address = "Germany",

edition = "1",

note = "Fundamental Approaches to Software Engineering ; Conference date: 22-04-2017 Through 29-04-2017",

url = "https://www.etaps.org/index.php/2017/fase",

}

Ben Henda, N, Johansson, B, Lantz, P, Norrman, K, Saaranen, P & Segersvärd, O 2017, OpenSAW: Open Security Analysis Workbench. in M Huisman & J Rubin (eds), Fundamental Approaches to Software Engineering: 20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings. 1 edn, vol. 10202, Springer, Berlin Heidelberg, pp. 321-337, Fundamental Approaches to Software Engineering, Uppsala, Sweden, 2017/04/22. https://doi.org/10.1007/978-3-662-54494-5

OpenSAW: Open Security Analysis Workbench. / Ben Henda, Noomene; Johansson, Björn ; Lantz, Patrik et al.
Fundamental Approaches to Software Engineering: 20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings. ed. / Marieke Huisman; Julia Rubin. Vol. 10202 1. ed. Berlin Heidelberg: Springer, 2017. p. 321-337.

Research output: Chapter in Book/Report/Conference proceeding › Paper in conference proceeding › peer-review

TY - GEN

T1 - OpenSAW: Open Security Analysis Workbench

AU - Ben Henda, Noomene

AU - Johansson, Björn

AU - Lantz, Patrik

AU - Norrman, Karl

AU - Saaranen, Pasi

AU - Segersvärd, Oskar

N1 - Conference code: 20

PY - 2017/4/22

Y1 - 2017/4/22

N2 - Software is today often composed of many sourced components, which potentially contain security vulnerabilities, and therefore require testing before being integrated. Tools for automated test case generation, for example, based on white-box fuzzing, are beneficial for this testing task. Such tools generally explore limitations of the specific underlying techniques for solving problems related to, for example, constraint solving, symbolic execution, search heuristics and execution trace extraction. In this article we describe the design of OpenSAW, a more flexible general-purpose white-box fuzzing framework intended to encourage research on new techniques identifying security problems. In addition, we have formalized two unaddressed technical aspects and devised new algorithms for these. The first relates to generalizing and combining different program exploration strategies, and the second relates to prioritizing execution traces. We have evaluated OpenSAW using both in-house and external programs and identified several bugs.

AB - Software is today often composed of many sourced components, which potentially contain security vulnerabilities, and therefore require testing before being integrated. Tools for automated test case generation, for example, based on white-box fuzzing, are beneficial for this testing task. Such tools generally explore limitations of the specific underlying techniques for solving problems related to, for example, constraint solving, symbolic execution, search heuristics and execution trace extraction. In this article we describe the design of OpenSAW, a more flexible general-purpose white-box fuzzing framework intended to encourage research on new techniques identifying security problems. In addition, we have formalized two unaddressed technical aspects and devised new algorithms for these. The first relates to generalizing and combining different program exploration strategies, and the second relates to prioritizing execution traces. We have evaluated OpenSAW using both in-house and external programs and identified several bugs.

U2 - 10.1007/978-3-662-54494-5

DO - 10.1007/978-3-662-54494-5

M3 - Paper in conference proceeding

SN - 978-3-662-54493-8

VL - 10202

SP - 321

EP - 337

BT - Fundamental Approaches to Software Engineering

A2 - Huisman, Marieke

A2 - Rubin, Julia

PB - Springer

CY - Berlin Heidelberg

T2 - Fundamental Approaches to Software Engineering

Y2 - 22 April 2017 through 29 April 2017

ER -

Ben Henda N, Johansson B, Lantz P, Norrman K, Saaranen P, Segersvärd O. OpenSAW: Open Security Analysis Workbench. In Huisman M, Rubin J, editors, Fundamental Approaches to Software Engineering: 20th International Conference, FASE 2017, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2017, Uppsala, Sweden, April 22-29, 2017, Proceedings. 1 ed. Vol. 10202. Berlin Heidelberg: Springer. 2017. p. 321-337 doi: 10.1007/978-3-662-54494-5

OpenSAW: Open Security Analysis Workbench

Abstract

Conference

Subject classification (UKÄ)

Access to Document

Fingerprint

Cite this