The week's pick
Random Articles
Reseach Article
Application of T-SEC to Measure the Performance of Static Analyzers and Penetration Testing Approaches
| International Journal of Computer Applications |
| Foundation of Computer Science (FCS), NY, USA |
| Volume 183 - Number 29 |
| Year of Publication: 2021 |
| Authors: Akwasi Amponsah, Richard Amankwah, Daniel PaaKorsah |
10.5120/ijca2021921677
|
Akwasi Amponsah, Richard Amankwah, Daniel PaaKorsah . Application of T-SEC to Measure the Performance of Static Analyzers and Penetration Testing Approaches. International Journal of Computer Applications. 183, 29 ( Oct 2021), 33-36. DOI=10.5120/ijca2021921677
Abstract
Software vulnerability analysis is very relevant in the process of investigating the existence of bugs (referred to as vulnerabilities) in software application. Recently, several empirical studies such as static code analyzers (SCA) and penetration testing approaches such as web vulnerability scanners (WVS) have been purported to aid the analysis of vulnerabilities in web applications. Although, there are several SCA and penetration testing tools (both open and commercial source) proposed in literature, the performance of these tools varies and make vendors skeptical in relation to the one most suited for detecting a particular type of vulnerability or bug, have a high precision and recall value, a low false positive and a high detection rate.In this study, we applied the standard evaluation criteria (T-SEC), namely precision and recall, Youden index, OWASP web benchmark evaluation (WBE) and the web application security scanner evaluation criteria (WASSEC) to measure the performance of the aforementioned approaches using the Damn Vulnerable Web Application (DVWA) and extracted report from the Juliet Test Suite.
References
- N. Antunes and M. Vieira, "Benchmarking vulnerability detection tools for web services," in 2010 IEEE International Conference on Web Services, 2010, pp. 203-210.
- C. L. Blackmon, D. F. Sang, and C.-S. Peng, "Performance Evaluation of Automated Static Analysis Tools," GSTF Journal on Computing (JoC), vol. 2, 2014.
- Y.-H. Tung, S.-S. Tseng, J.-F. Shih, and H.-L. Shan, "A cost-effective approach to evaluating security vulnerability scanner," in 2013 15th Asia-Pacific Network Operations and Management Symposium (APNOMS), 2013, pp. 1-3.
- Y. Makino and V. Klyuev, "Evaluation of web vulnerability scanners," in 2015 IEEE 8th International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), 2015, pp. 399-402.
- E. Goubault and S. Putot, "Static analysis of finite precision computations," in International Workshop on Verification, Model Checking, and Abstract Interpretation, 2011, pp. 232-247.
- N. Ayewah, W. Pugh, D. Hovemeyer, J. D. Morgenthaler, and J. Penix, "Using static analysis to find bugs," IEEE software, vol. 25, pp. 22-29, 2008.
- W. J. Youden, "Index for rating diagnostic tests," Cancer, vol. 3, pp. 32-35, 1950.
- W. A. S. Consortium, "Web application security scanner evaluation criteria WASSEC," ed, 2016.
- "OWASPBenchmarkProject. https://www.owasp.org/index.php/Benchmark (visited 2016-06-2).", ed, 2016.
- P. E. Black, "Samate and evaluating static analysis tools," Ada User Journal, vol. 28, pp. 184-188, 2007.
- Y. Makino and V. Klyuev, "Evaluation of web vulnerability scanners," in Proceedings of the 8th IEEE International Conference on Intelligent Data Acquisition and Advanced Computing Systems: Technology and Applications (IDAACS), 2015, 2015, pp. 399-402.
- R. Amankwah, P. K. Kudjo, B. K. Agyman, K. Mensah, B. Brew, and S. Y. Antwi, "A Theoretical Framework for Software Vulnerability Detection based on Cascaded Refinement Network," International Journal of Computer Applications, vol. 975, p. 8887.
- N. Ayewah, W. Pugh, J. D. Morgenthaler, J. Penix, and Y. Zhou, "Evaluating static analysis defect warnings on production software," in Proceedings of the 7th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering, 2007, pp. 1-8.
- N. Rutar, C. B. Almazan, and J. S. Foster, "A comparison of bug finding tools for Java," in null, 2004, pp. 245-256.
- H. H. AlBreiki and Q. H. Mahmoud, "Evaluation of static analysis tools for software security," in Proceedings of 2014 10th International Conference on Innovations in Information Technology (INNOVATIONS), , 2014, pp. 93-98.
- C. Artho, "Finding faults in multi-threaded programs," ed, 2001.
- J. C. Corbett, M. B. Dwyer, J. Hatcliff, S. Laubach, C. S. Pasareanu, and H. Zheng, "Bandera: Extracting finite-state models from Java source code," in Proceedings of the 2000 International Conference on Software Engineering. ICSE 2000 the New Millennium, 2000, pp. 439-448.
- C. Flanagan, K. R. M. Leino, M. Lillibridge, G. Nelson, J. B. Saxe, and R. Stata, "Extended static checking for Java," ACM Sigplan Notices, vol. 37, pp. 234-245, 2002.
- T. P. Chiem, "A study of penetration testing tools and approaches," Auckland University of Technology, 2014.
- C. Mainka, J. Somorovsky, and J. Schwenk, "Penetration testing tool for web services security," in 2012 IEEE Eighth World Congress on Services, 2012, pp. 163-170.
- N. Antunes and M. Vieira, "Penetration testing for web services," Computer, vol. 47, pp. 30-36, 2013.
- H. M. Z. Al Shebli and B. D. Beheshti, "A study on penetration testing process and tools," in 2018 IEEE Long Island Systems, Applications and Technology Conference (LISAT), 2018, pp. 1-7.
- R. Amankwah, J. Chen, P. K. Kudjo, and D. Towey, "An empirical comparison of commercial and open‐source web vulnerability scanners," Software: Practice and Experience, vol. 50, pp. 1842-1857, 2020.
Index Terms
Keywords