面向Web应用的安全评测技术研究
|
摘要
随着Internet的普及和发展以及Web应用技术的发展和研究的深入,已经有越来越多的Web应用系统被部署在Internet上以提供各式各样的应用服务,由于Web应用提供的服务的开放性使其时刻面临着潜在的恶意攻击者的威胁；而从另一个方面来说由于Web应用设计者的经验或者其他因素,使得Web应用系统对信息的保密和系统的安全考虑不太完备,或者存在一定的设计缺陷、编码缺陷、或者在维护中出现配置缺陷,这些情况造成了造成现在Web应用面临的攻击与破坏事件层出不穷。
由于其地位的重要性以及面临安全威胁的严峻性,Web安全问题已引起人们的极大重视,但是传统的安全保证技术,如防火墙,IDS,IPS只能在面对攻击时可能起到效果,而在平常的使用过程中无法确认其安全状态,而且Web应用程序以及运行Web应用程序的服务器也都存在平常使用中无法检查其安全防护功能的问题。在这样的背景下,进行Web应用进行安全评测就有很强的现实意义。
为了解决这些问题,本文以Web应用安全评测为研究目的,研究了国内外已有的通用的以及专门针对Web应用的信息安全评估、安全测评标准以及技术,借鉴现有的检测框架,提出了一个通用的Web应用安全评估通用框架；并且结合对Web应用所面临的安全威胁,将针对Web应用的安全评测分为三个层次：Web应用程序层,Web应用服务层,以及底层的网络边界层。分别针对这三个层面的内容进行Web安全测评的研究,并在最后提出一个Web应用安全测评管理平台,将这些研究内容按照前面提出的检测框架整合在此平台中,以实现对Web应用的安全测评工作。本文主要工作和研究成果如下所示：
1.在网络边界层,研究了Web应用拓扑结构安全评测的相关技术,使用邻接矩阵来描述拓扑结构,使用二叉决策图来描述可能存在的约束问题,将拓扑结构安全评测问题分解为不包含逻辑约束的拓扑安全评测、包含逻辑约束的拓扑安全评测两种大的类型,并在解决前一个问题的基础上,研究对约束进行化简,并依照约束将其反映至邻接矩阵中从而解决解决Web应用拓扑结构安全评测的问题。以此来作为对Web应用安全评测中网络边界安全评估中的重要内容。
2.在Web应用程序层面上研究了Web应用黑盒测试相关技术,实现了一套通过状态机对Web程序进行记录建模并根据实际标准的要求具体化功能和安全需求,然后通过远程的黑盒测试对Web应用进行测试并获取具体的检测结果的检验方法,同时在这个方法中引入了一个自学习的输入处算法来发现更多的状态和安全问题。
3.在Web应用服务层面研究了Web应用服务配置的安全评测技术,通过Web应用服务的配置以及对应的配置检查项的描述方法进行研究,并在这些研究定义的基础上将Web应用服务配置分为命令行接口型的配置以及文本型的配置两种类型,分别针对这两种类型的配置形式提出了对其进行配置安全性评测的方法,并研究了在此基础上的具有通用性的结果评估方法。
4.在对三个层面的技术进行研究之后,提出了一个Web应用安全评测管理平台的结构和具体的模块设计,这个评测管理平台基于Web应用安全评估通用框架、实现了Web应用安全评测的整体流程,并在最大程度上实现了评测的自动化操作。
With the popularity of Internet and the rapid development and profound research on web application technology, more and more web applications are deployed in the Internet, to provide a wide range of services. The web applications are exposed to potentially malicious attackers because of it's openness, what's more,the experience of the web application developers is another constraint for the security of web applications,which results to the incomplete security concern on web applications such as defects in designing,coding and configuration. This situation has created cause of growing incidence of attacks towards web applications.
Because of its importance and the seriousness of the threat faced, web security issue has aroused great attention. While the traditional safety assurance techniques, such as firewall, IDS, IPS can only be available in function when encountering attack, and the security functions are invalid in the ordinary application scene. It's difficult to check security function of web applications and web application servers when they are operating.In this context, the web application security assessments have great practical significance.
To address these issues, we aim at web application security evaluation for research. We study the existing domestic and international general and specialized information for web application security assessment, security evaluation standards and technology, by doing this, we proposed a common web application security assessment framework building on the existing testing framework. In our research,security threats of web applications are divided into three levels:web application layer, web service layer and the underlying network layer. And we study web security assessment on these three aspects. In the end of this paper we propose an evaluating and administrating platform of web application security, the content of the studies will be integrated to the platform, which will be a push to the security of web applications evaluation work. The work and research in this paper follows:
1. On the underlying network layer, we studied the technology on security assessment of web application topology. We use adjacency matrix to represent the topology and get the result by matrix comparation. We store the constraints with BDD and solve the constraints with BDD simplification. In our method, the topology conformance test is divided into two types:the one with constraints and the one without.Based on the former one which is part of the latter, we simplify the constraints and modify the matrix to solve the problem.This research plays an important part of web application security assessment in the network of border security.
2. On the web application layer, we study web application-related black box testing technology and present a method for security evaluation for web applications.In our method, we store the state of applications with state machine and specify the functions by the standard.The remote black box testing is introduced to carry security assessment to get the result.We also introduced a self-learning algorithm to generate proper content in this method to find more state and security issues.
3. On the web service layer, we study the web applications security evaluation technology on configration.Firstly,we do our research on configuration of web applications and the corresponding description of the configuration checking,and then we divide web services configuration into two types:the command line interface type, the text-based type.we respectively prospect security evaluation methods for these two types,and at last, we proposed a method for general assessment of the testing results.
4. We proposed an evaluating and administrating platform of web application security and detailed the structure and the design of modules. This paltform are base on the common framework for web application security assessment and the the overall web application security evaluation process are implemented which can maxmize the automation of evaluation.
由于其地位的重要性以及面临安全威胁的严峻性,Web安全问题已引起人们的极大重视,但是传统的安全保证技术,如防火墙,IDS,IPS只能在面对攻击时可能起到效果,而在平常的使用过程中无法确认其安全状态,而且Web应用程序以及运行Web应用程序的服务器也都存在平常使用中无法检查其安全防护功能的问题。在这样的背景下,进行Web应用进行安全评测就有很强的现实意义。
为了解决这些问题,本文以Web应用安全评测为研究目的,研究了国内外已有的通用的以及专门针对Web应用的信息安全评估、安全测评标准以及技术,借鉴现有的检测框架,提出了一个通用的Web应用安全评估通用框架；并且结合对Web应用所面临的安全威胁,将针对Web应用的安全评测分为三个层次：Web应用程序层,Web应用服务层,以及底层的网络边界层。分别针对这三个层面的内容进行Web安全测评的研究,并在最后提出一个Web应用安全测评管理平台,将这些研究内容按照前面提出的检测框架整合在此平台中,以实现对Web应用的安全测评工作。本文主要工作和研究成果如下所示：
1.在网络边界层,研究了Web应用拓扑结构安全评测的相关技术,使用邻接矩阵来描述拓扑结构,使用二叉决策图来描述可能存在的约束问题,将拓扑结构安全评测问题分解为不包含逻辑约束的拓扑安全评测、包含逻辑约束的拓扑安全评测两种大的类型,并在解决前一个问题的基础上,研究对约束进行化简,并依照约束将其反映至邻接矩阵中从而解决解决Web应用拓扑结构安全评测的问题。以此来作为对Web应用安全评测中网络边界安全评估中的重要内容。
2.在Web应用程序层面上研究了Web应用黑盒测试相关技术,实现了一套通过状态机对Web程序进行记录建模并根据实际标准的要求具体化功能和安全需求,然后通过远程的黑盒测试对Web应用进行测试并获取具体的检测结果的检验方法,同时在这个方法中引入了一个自学习的输入处算法来发现更多的状态和安全问题。
3.在Web应用服务层面研究了Web应用服务配置的安全评测技术,通过Web应用服务的配置以及对应的配置检查项的描述方法进行研究,并在这些研究定义的基础上将Web应用服务配置分为命令行接口型的配置以及文本型的配置两种类型,分别针对这两种类型的配置形式提出了对其进行配置安全性评测的方法,并研究了在此基础上的具有通用性的结果评估方法。
4.在对三个层面的技术进行研究之后,提出了一个Web应用安全评测管理平台的结构和具体的模块设计,这个评测管理平台基于Web应用安全评估通用框架、实现了Web应用安全评测的整体流程,并在最大程度上实现了评测的自动化操作。
With the popularity of Internet and the rapid development and profound research on web application technology, more and more web applications are deployed in the Internet, to provide a wide range of services. The web applications are exposed to potentially malicious attackers because of it's openness, what's more,the experience of the web application developers is another constraint for the security of web applications,which results to the incomplete security concern on web applications such as defects in designing,coding and configuration. This situation has created cause of growing incidence of attacks towards web applications.
Because of its importance and the seriousness of the threat faced, web security issue has aroused great attention. While the traditional safety assurance techniques, such as firewall, IDS, IPS can only be available in function when encountering attack, and the security functions are invalid in the ordinary application scene. It's difficult to check security function of web applications and web application servers when they are operating.In this context, the web application security assessments have great practical significance.
To address these issues, we aim at web application security evaluation for research. We study the existing domestic and international general and specialized information for web application security assessment, security evaluation standards and technology, by doing this, we proposed a common web application security assessment framework building on the existing testing framework. In our research,security threats of web applications are divided into three levels:web application layer, web service layer and the underlying network layer. And we study web security assessment on these three aspects. In the end of this paper we propose an evaluating and administrating platform of web application security, the content of the studies will be integrated to the platform, which will be a push to the security of web applications evaluation work. The work and research in this paper follows:
1. On the underlying network layer, we studied the technology on security assessment of web application topology. We use adjacency matrix to represent the topology and get the result by matrix comparation. We store the constraints with BDD and solve the constraints with BDD simplification. In our method, the topology conformance test is divided into two types:the one with constraints and the one without.Based on the former one which is part of the latter, we simplify the constraints and modify the matrix to solve the problem.This research plays an important part of web application security assessment in the network of border security.
2. On the web application layer, we study web application-related black box testing technology and present a method for security evaluation for web applications.In our method, we store the state of applications with state machine and specify the functions by the standard.The remote black box testing is introduced to carry security assessment to get the result.We also introduced a self-learning algorithm to generate proper content in this method to find more state and security issues.
3. On the web service layer, we study the web applications security evaluation technology on configration.Firstly,we do our research on configuration of web applications and the corresponding description of the configuration checking,and then we divide web services configuration into two types:the command line interface type, the text-based type.we respectively prospect security evaluation methods for these two types,and at last, we proposed a method for general assessment of the testing results.
4. We proposed an evaluating and administrating platform of web application security and detailed the structure and the design of modules. This paltform are base on the common framework for web application security assessment and the the overall web application security evaluation process are implemented which can maxmize the automation of evaluation.
引文
[1]Boyd Danah, Ellison Nicole. Social Network Sites:Definition, History, and Scholarship. Journal of Computer-Mediated Communication 13 (1).2007
[2]T. Holz, S. Marechal and F. Raynal, New Threats and Attacks on the World Wide Web, In Proeeedings of IEEE Security and Privacy 2006. issue 2,72-76
[3]Technology Research| Gartner Inc.http://www.gartner.com/.2011-05-01
[4]National Institute of Standards and Technology (NIST). http://www.nist.gov/. 2011-05-01
[5]Software Security Testing:Let's Get Back to Basics. http://www.softwaremag. com/focus-areas/security/featured-articles/software-security-testing-lets-get-back-to-basics.2011-05-01
[6]OWASP. http://www.owasp.org/.2011-05-01
[7]WHID.http://projects.Webappsec.org/Web-Hacking-Incident-Database. 2011-04-24
[8]OWASP Top 10 for 2010. http://owasptop10.googlecode.com/files/OWASP Top 10-2010.pdf.2011-04-24
[9]Web Hacking Incidents Database. http://projects.Webappsec.org/w/page/ 13246995/Web-Hacking-Incident-Database.2011-04-24
[10]Alhazmi,O.H.andMalaiya,Y.K Measuxinget et al.enhanceing Prediction capabilities of vulnerabilities discovery models for Apache and IIS HTTP servers. In Proeeedings of 17th IEEE International Symposium on Software Reliability Engineering(ISSRE'06). Raleigh,2006,343-352
[11]Sung-Whan,W.Alhazmi,O.H. Malaiya et al. Assessing Vulnerabilities in Apache and IIS HTTP Servers, in Proeeedings of IEEE International Symposium on Dependable Autonomic and Secure Computing(DASC,06), IndianaPolis, Indiana, USA:IEEE CS,2006,103-110
[12]Elisa Bertino, Ravi Sandhu.Database Security-Concepts, Approaches, and Challenges.IEEE Transactions on Dependable and Secure Computing.2005. 2-19
[13]O.H. Alhazmi,Y.K.Malaiya. Application of Vulnerability Discovery Models to Major Operating Systems.IEEE Transaetions on Reliability 2008,57(1):14-22
[14]Pal,P.,Webber,F. SchantZ,R.E,et al.Intrusion Tolerant Systems in Proeeedings of the IEEE Information Survivability Workshop(ISW22000). Boston,2000, 24-26
[15]Paulo,S, Alysson N. Bessan,I,et al.Resilient Intrusion Toleranee through Proactive and Reactive Recovery.In Proeeedings of the 13th IEEE Pacific Rim International Symposium on Dependable Computing.Washington, DC,2007, 373-380
[16]J.P.,MeDermott. Attack Net Penetration Testing.In:Proeeedings of the 2000 Workshop on New Seeurity Paradlgms(NSPW2000),Ballyeotton,Ireland,2000, 15-21
[17]O.Dahl,S. Wolthusen.Modeling and exeeution of complex attacks cenarios using interval timed eolored Petrinets.in:Proeeedings of the Fourth IEEE International Workshop on Information Assuranee(IWIA' 06).USA.2006. 157-168
[18]苘大鹏,周渊,杨武等.用于评估网络整体安全性的攻击图生成方法.通信学报.2009年03期.1-5
[19]朱华平.基于模糊petri网的攻击模型FAN及其扩展模型.[学位论文].西安.西安建筑科技大学.2006
[20]W.L.,Du, P.Mathur. Vulnerabllity Testing of Software System Using Fanlt Injeetion, http://www.cerias.purdue.edu/ssl/techreports-ssl/98-02.pdf,Technical Purdue University:West Lafayette,1998,1-20
[21]单国栋,连一峰.环境错误注入测试机制.计算机工程,2004,30(19),113-114
[22]袁昌龙.基于错误注入的组件安全性测试研究.[学位论文].武汉.华中科技大学.2008
[23]Alberts, J.Christopher, and A.J.Dorofee. OCTAVE method implementation guide, v2.0. Pittsburgh, PA:Software Engineering Institute, Carnegie Mellon University,2001.
[24]闫强,舒华英,陈钟等.一种面向对象的信息系统安全评估方法.北京邮电大学学报.2005年04期.69-73
[25]段云所,刘欣,陈钟等.信息系统组合安全强度和脆弱性分析.北京大学学报(自然科学版),41(3),2005,484-490.
[26]汤永利,徐国爱,杨义先等.基于信息熵的信息安全风险分析模型.北京邮电大 学学报,31(2),2008,50-53.
[27]L.Labuschagne, JHP Eloff. The use of real-time risk analysis to enable dynamic activation of counter measures. Computers and Security,17(4),1998,347-357.
[28]Lynete Bsmard, Rossouwvon Solums. A formalized approach to the effective selection and evaluation of information security control. Computers and Security, Vol.8,2001,185-194.
[29]刘芳.信息系统安全评估理论及其关键技术研究.[学位论文],长沙, 国防科学技术大学,2005.
[30]朱方洲.基于BS7799的信息系统安全风险评估研究.[学位论文],合肥,合肥工业大学,2007.
[31]阎强.信息系统安全评估研究.[学位论文],北京,北京大学,2003.
[32]史简,郭山清,谢立.一种实时的信息安全风险评估方法.计算机工程与应用,(1),2006,109-111.
[33]李嵩,孟亚平,孙铁等.一种基于模型的信息安全风险评估方法.计算机工程与应用,(29),2005,159-162.
[34]C&A. System's security:The COBRA risk consultant methodology. Jul.1999.
[35]CCRA. Risk Analysis and Management Method. http://www.cramm. com/.
[36]NIST. Automated Security Self-Evaluation Tool (ASSET), http://csrc.nist.gov/ archive/asset/.2011-04-24
[37]Cost of Risk Analysis(CORA), Intenational Security Technology,Inc, http://www.ist-usa.com,2011-05-01
[38]Ketil Stolen.Model-based risk assessment-the CORAS approach.In Proceeding of the 1st iTrust Workshop,Glasgow,Septermber,2002.
[39]范红,冯登国,吴亚非.信息安全风险评估方法与应用.北京：清华大学出版社,2006.
[40]Harold A. Linstone, Murray Turoff. The Delphi Method:Techniques and Applications,.Reading, Mass:Adison-Wesley,1975
[41]Alberts, J.Christopher, A J.Dorofee.et al. OCTAVE method implementation guide, v2.0. Pittsburgh, PA:Software Engineering Institute, Carnegie Mellon University,2001.
[42]Bloomfield, P. Fourier analysis of time series:An introduction. New York: Wiley.1976
[43]T. L.Satty,The analysis hierarchy process. New York L:McGrae-Hill,1980.
[44]T. Bedford, R.Cooke. Probabilistic risk analysis. Cambridge University Press, 2001.
[45]Jensen M.W.1, Leathrum, J.F. Conformance test design methodology and assertion driven test case generator for the conformance testing of interface standards, in Proceedings of IEEE SOUTHEASTCON,1991,v2,1221-1225,
[46]Chang Jeong Woo, Lee Young Shin. Topology optimization of compressor bracket, Journal of Mechanical Science and Technology.2008.1668-1676,
[47]Mayer A, Wool A, Ziskind E. Fang:A firewall analysis engine, in Proceedings of the IEEE Symposium on Security and Privacy. Oakland,2000.177-187
[48]Ritchey R, Ammann P. Using model checking to analyze network vulnerabilities in Proceedings of the IEEE Symposium on Security and Privacy. Oakland,2000.156-165
[49]Ritchey R, O' Berry B, Noel S. Representing TCP/IP connectivity for topological analysis of network security in Proceedings of t he 18t h Annual Computer Security Applications Conference. Las Vegas,2002.25-31
[50]J ajodia S, Noel S, O' Berry B. Topological analysis of network attack vulnerability. in Proceedings of the 2nd ACM symposium on Information, computer and communications security.Singapore.2007.
[51]Michael T. Goodrich and Roberto Tamassia.Data Structures and Algorithms in Java (4th ed.). Wiley.2006.369-418.
[52]Donald E. Knuth.The Art of Computer Programming. vol 4A,7.1.4, Addison-Wesley Professional.2005
[53]Ch. Meinel, T. Theobald.Algorithms and Data Structures in VLSI-Design: OBDD-Foundations and Applications, Springer-Verlag, Berlin, Heidelberg, New York,1998.
[54]CUDD v.2.3.1, Software Ported to Windows,http://Web.cecs.pdx.edu/-alanmi/ research/soft/softPorts.htm.2011-04-24
[55]Matrix TCL Lite. A C++ Matrix Template Class Library for Programmers. http://www.techsoftpl.com/matrix/matlite.htm.2011-04-25
[56]J. M. Caffrey.Automatisation de test ajax. in MSDN magazin.Feb.2007
[57]J. Larson.Testing ajax applications with selenium.in InfoQ magazine,2006.
[58]A. Marchetto, P. Tonella, F. Ricca. State-based testing of ajax Web applications, in Proceedings of the 2008 International Conference on Software Testing, Verification, and Validation.2008.121-130.
[59]郑冬冬,赵朋朋,崔志明Deep Web爬虫研究与设计.清华大学学报(自然科学版).2005年S1期.1896-1902
[60]P. Ipeirotis, L. Gravano. Distributed search over the hidden Web:hierarchical database sampling and selection.in Proceedings of The 28th International Conference on Very Large Databases.Hong Kong.China. August 2002.394-405.
[61]Stephen W. Liddle, David W. Embley, Del T. Scott,et al. Extracting data behind Web forms. Lecture Notes in Computer Science,2003, Volume 2784.
[62]Yao-Wen Huang, Chung-Hung Tsaib, Tsung-Po Lin et al,A testing framework for Web application security assessment,in Computer Networks 48 (2005), 739-761
[63]M. Benedikt, J. Freire, P. Godefroid.VeriWeb:Automatically testing dynamic Web sites.in Proceedings of the 11th International Conference on the World Wide Web, Hono-lulu.2002.
[64]OWASP, WebScarab Project. http://www.owasp.org/Webscarab/.2011-05-01
[65]PAROS. Paros-security tool for web application vulnerability assessment. http://www.parosproxy.org.2011-05-01
[66]Gill, A. Introduction to the Theory of Finite-state Machines. McGraw-Hill, 1962.
[67]Levenshtein VI. Binary codes capable of correcting deletions, insertions, and reversals. Soviet Physics Doklady,1966,10:707-10.
[68]Lawrence A. Cunningham. Language, Deals and Standards:The Future of XML Contracts. Washington University Law Review.2005.
[69]Bergeron, Randy.XPath—Retrieving Nodes from an XML Document.SQL Server Magazine.2000.
[70]WebSPHINX:A Personal, Customizable Web Crawler. http://www.cs.cmu.edu/-rcm/Websphinx/.2011-05-01
[71]JoBo. http://www.matuschek.net/jobo/.2011-05-01
[72]crawler4j. crawler4j-Open Source Web Crawler for Java-Google Project Hosting, http://code.googlc.com/p/crawler4j/.2011-05-01
[73]Larbin Multi-purpose Web crawler.http://larbin.sourceforge.net/index-eng.html. 2011-05-01
[74]Web browser.http://en.wikipedia.org/wiki/Web_browser.2011-05-01
[75]RFC 3986,Uniform Resource Identifier (URI):Generic Syntax, http://labs.apache.org/Webarch/uri/rfc/rfc3986.html.2011-05-01
[76]A. Mesbah,A. van Deursen. Migrating multi-page Web applications to single-page Aj ax interfaces, in Proceedings of the 11th European Conference on Software Maintenance and Reengineering (CSMR'07).2007.181-190.
[77]Depth-first search.http://en.wikipedia.org/wiki/Depth-first_search.2011-05-01
[78]V. L. Levenshtein. Binary codes capable of correcting deletions,insertions, and reversals. Cybernetics and Control Theory,1996.10:707-710,
[79]D. Scott, R. Sharp.Abstracting application-level Web security. in Proceedings of The 11th International Conference on theWorld WideWeb, Honolulu. May 2002,396-407.
[80]M.K. Bergman.The deep Web:surfacing hidden value, Deep Content Whitepaper.2001.
[81]Ari Takanen, Jared D. DeMott, Charles Miller.Fuzzing for Software Security Testing and Quality Assurance,Artech House.2008.
[82]SPIKE. IMMUNITY:Knowing You're Secure. http://www.immunitysec.com/resources-freesoftware.shtml.2011-05-01
[83]Sulley.http://www.fuzzing.org/wp-content/Sulley Fuzzing Framework.exe, 2011-05-01
[84]Scratch.http://packetstormsecurity.org/UNIX/misc/scratch.rar.2011-05-01
[85]S. Raghavan, H. Garcia-Molina.Crawling the hidden Web. in Proceedings of the 27th VLDB Conference.Roma.2001.129-138.
[86]Category:OWASP WebGoat Project.https://www.owasp.org/index.php/. 2011-05-01
[87]Sprajax.http://www.owasp.org/index.php/Category:OWASP_Sprajax_Project. 2011-05-01
[88]Neto Afonso Araujo, Vieira Marco, Madeira Henrique. An Appraisal to Assess the Security of Database Configurations.in Proceedings of 2009 International Conference on Dependability, DEPEND 2009,73-80
[89]Xiaomei Yi, Peng Wu. Security Audit System Using Adaptive Genetic Algorithm and Support Vector Machine, in Proceedings of ICACTE 2010-2010 3rd International Conference on Advanced Computer Theory and Engineering.2010.V3265-V3268.
[90]Niu Honghui,Shang Yanling.Research on risk assessment model of information security based on particle swarm algorithm-RBF neural network. in Proceedings of 2010 2nd Pacific-Asia Conference on Circuits, Communications and System.2010.479-482.
[91]D. Caldwell, A. Gilbert, J. Gottlieb et al. The cutting EDGE of IP router configuration. In Proceedings of ACM HotNets Workshop,2003.
[92]Alcatel-Lucent.7750 SR OS Basic System Configuration Guide,2007.
[93]王升保.信息安全等级保护体系研究及应用.[学位论文],合肥,合肥工业大学,2009
[94]张笑笑,张艳,顾健.等级测评中主机安全配置检查方法研究,全国计算机安全学术交流会论文集·第二十五卷,2010
[95]Lynis.http://www.rootkit.nl/projects/lynis.html.2011-05-01
[96]bastille-unix.http://www.bastille-unix.org/index.html.2011-05-01
[97]MABA. http://www.microsoft.com/china/windowsxp/pro/winxppro/tools/ mbsahome.mspx.2011-05-01
[98]Hubert Zimmermann.OSI Reference Model—The ISO Model of Architecture for Open Systems Interconnection. IEEE Transactions on Communications, vol. 28, no.4, April 1980.425-432
[99]Microsoft Corporation.Update Management Process.2007.http://www.micros oft.com/technet/security/guidance/patchmanagement/secmod 193.mspx. 2011-05-01
[100]Steven Christey,Robert A. Martin. Vulnerability Type Distribution in CVE.2007.
[101]Fortify, A Taxonomy of Coding Errors that Affect Security. https://www.fortify. com/vulncat/en/vulncat/index.html.2011-05-01
[102]XCCDF. http://en.wikipedia.org/wiki/XCCDF.2011-05-01
[103]Federal Desktop Core Configuration (FDCC). http://cit.nih.gov/Support/ FAQ/Fdcc/.2011-05-01
[104]Aho, Alfred V. Algorithms for finding patterns in strings. Handbook of Theoretical Computer Science,.volume A:Algorithms and Complexity. The MIT Press.1990.255-300
[105]Windows Registry,http://en.wikipedia.org/wiki/Windows_Registry. 2011-05-01
[106]Joris Graaumans.Usability of XML Query Languages. SIKS Dissertation Series No 2005-16,2005
[107]G. Cobena, S. Abiteboul, and A. Marian. Detecting changes in XML documents.in Proceedings of IEEE International Conference on Data Engineering (ICDE),2002.41-52
[108]T. Lindholm, J. Kangasharju, S. Tarkoma. Fast and simple XML tree differencing by sequence alignment.in Proceedings of ACM Symposium on Document Engineering ACM,2006.
[109]Y. Wang, D. DeWitt, J.-Y. Cai. X-diff:An effective change detection algorithm for XML documents. In Proceedings of IEEE ICDE,2003.519-530
[110]Diff utils, http://www.gnu.org/software/diffutils/.2011-05-01
[2]T. Holz, S. Marechal and F. Raynal, New Threats and Attacks on the World Wide Web, In Proeeedings of IEEE Security and Privacy 2006. issue 2,72-76
[3]Technology Research| Gartner Inc.http://www.gartner.com/.2011-05-01
[4]National Institute of Standards and Technology (NIST). http://www.nist.gov/. 2011-05-01
[5]Software Security Testing:Let's Get Back to Basics. http://www.softwaremag. com/focus-areas/security/featured-articles/software-security-testing-lets-get-back-to-basics.2011-05-01
[6]OWASP. http://www.owasp.org/.2011-05-01
[7]WHID.http://projects.Webappsec.org/Web-Hacking-Incident-Database. 2011-04-24
[8]OWASP Top 10 for 2010. http://owasptop10.googlecode.com/files/OWASP Top 10-2010.pdf.2011-04-24
[9]Web Hacking Incidents Database. http://projects.Webappsec.org/w/page/ 13246995/Web-Hacking-Incident-Database.2011-04-24
[10]Alhazmi,O.H.andMalaiya,Y.K Measuxinget et al.enhanceing Prediction capabilities of vulnerabilities discovery models for Apache and IIS HTTP servers. In Proeeedings of 17th IEEE International Symposium on Software Reliability Engineering(ISSRE'06). Raleigh,2006,343-352
[11]Sung-Whan,W.Alhazmi,O.H. Malaiya et al. Assessing Vulnerabilities in Apache and IIS HTTP Servers, in Proeeedings of IEEE International Symposium on Dependable Autonomic and Secure Computing(DASC,06), IndianaPolis, Indiana, USA:IEEE CS,2006,103-110
[12]Elisa Bertino, Ravi Sandhu.Database Security-Concepts, Approaches, and Challenges.IEEE Transactions on Dependable and Secure Computing.2005. 2-19
[13]O.H. Alhazmi,Y.K.Malaiya. Application of Vulnerability Discovery Models to Major Operating Systems.IEEE Transaetions on Reliability 2008,57(1):14-22
[14]Pal,P.,Webber,F. SchantZ,R.E,et al.Intrusion Tolerant Systems in Proeeedings of the IEEE Information Survivability Workshop(ISW22000). Boston,2000, 24-26
[15]Paulo,S, Alysson N. Bessan,I,et al.Resilient Intrusion Toleranee through Proactive and Reactive Recovery.In Proeeedings of the 13th IEEE Pacific Rim International Symposium on Dependable Computing.Washington, DC,2007, 373-380
[16]J.P.,MeDermott. Attack Net Penetration Testing.In:Proeeedings of the 2000 Workshop on New Seeurity Paradlgms(NSPW2000),Ballyeotton,Ireland,2000, 15-21
[17]O.Dahl,S. Wolthusen.Modeling and exeeution of complex attacks cenarios using interval timed eolored Petrinets.in:Proeeedings of the Fourth IEEE International Workshop on Information Assuranee(IWIA' 06).USA.2006. 157-168
[18]苘大鹏,周渊,杨武等.用于评估网络整体安全性的攻击图生成方法.通信学报.2009年03期.1-5
[19]朱华平.基于模糊petri网的攻击模型FAN及其扩展模型.[学位论文].西安.西安建筑科技大学.2006
[20]W.L.,Du, P.Mathur. Vulnerabllity Testing of Software System Using Fanlt Injeetion, http://www.cerias.purdue.edu/ssl/techreports-ssl/98-02.pdf,Technical Purdue University:West Lafayette,1998,1-20
[21]单国栋,连一峰.环境错误注入测试机制.计算机工程,2004,30(19),113-114
[22]袁昌龙.基于错误注入的组件安全性测试研究.[学位论文].武汉.华中科技大学.2008
[23]Alberts, J.Christopher, and A.J.Dorofee. OCTAVE method implementation guide, v2.0. Pittsburgh, PA:Software Engineering Institute, Carnegie Mellon University,2001.
[24]闫强,舒华英,陈钟等.一种面向对象的信息系统安全评估方法.北京邮电大学学报.2005年04期.69-73
[25]段云所,刘欣,陈钟等.信息系统组合安全强度和脆弱性分析.北京大学学报(自然科学版),41(3),2005,484-490.
[26]汤永利,徐国爱,杨义先等.基于信息熵的信息安全风险分析模型.北京邮电大 学学报,31(2),2008,50-53.
[27]L.Labuschagne, JHP Eloff. The use of real-time risk analysis to enable dynamic activation of counter measures. Computers and Security,17(4),1998,347-357.
[28]Lynete Bsmard, Rossouwvon Solums. A formalized approach to the effective selection and evaluation of information security control. Computers and Security, Vol.8,2001,185-194.
[29]刘芳.信息系统安全评估理论及其关键技术研究.[学位论文],长沙, 国防科学技术大学,2005.
[30]朱方洲.基于BS7799的信息系统安全风险评估研究.[学位论文],合肥,合肥工业大学,2007.
[31]阎强.信息系统安全评估研究.[学位论文],北京,北京大学,2003.
[32]史简,郭山清,谢立.一种实时的信息安全风险评估方法.计算机工程与应用,(1),2006,109-111.
[33]李嵩,孟亚平,孙铁等.一种基于模型的信息安全风险评估方法.计算机工程与应用,(29),2005,159-162.
[34]C&A. System's security:The COBRA risk consultant methodology. Jul.1999.
[35]CCRA. Risk Analysis and Management Method. http://www.cramm. com/.
[36]NIST. Automated Security Self-Evaluation Tool (ASSET), http://csrc.nist.gov/ archive/asset/.2011-04-24
[37]Cost of Risk Analysis(CORA), Intenational Security Technology,Inc, http://www.ist-usa.com,2011-05-01
[38]Ketil Stolen.Model-based risk assessment-the CORAS approach.In Proceeding of the 1st iTrust Workshop,Glasgow,Septermber,2002.
[39]范红,冯登国,吴亚非.信息安全风险评估方法与应用.北京：清华大学出版社,2006.
[40]Harold A. Linstone, Murray Turoff. The Delphi Method:Techniques and Applications,.Reading, Mass:Adison-Wesley,1975
[41]Alberts, J.Christopher, A J.Dorofee.et al. OCTAVE method implementation guide, v2.0. Pittsburgh, PA:Software Engineering Institute, Carnegie Mellon University,2001.
[42]Bloomfield, P. Fourier analysis of time series:An introduction. New York: Wiley.1976
[43]T. L.Satty,The analysis hierarchy process. New York L:McGrae-Hill,1980.
[44]T. Bedford, R.Cooke. Probabilistic risk analysis. Cambridge University Press, 2001.
[45]Jensen M.W.1, Leathrum, J.F. Conformance test design methodology and assertion driven test case generator for the conformance testing of interface standards, in Proceedings of IEEE SOUTHEASTCON,1991,v2,1221-1225,
[46]Chang Jeong Woo, Lee Young Shin. Topology optimization of compressor bracket, Journal of Mechanical Science and Technology.2008.1668-1676,
[47]Mayer A, Wool A, Ziskind E. Fang:A firewall analysis engine, in Proceedings of the IEEE Symposium on Security and Privacy. Oakland,2000.177-187
[48]Ritchey R, Ammann P. Using model checking to analyze network vulnerabilities in Proceedings of the IEEE Symposium on Security and Privacy. Oakland,2000.156-165
[49]Ritchey R, O' Berry B, Noel S. Representing TCP/IP connectivity for topological analysis of network security in Proceedings of t he 18t h Annual Computer Security Applications Conference. Las Vegas,2002.25-31
[50]J ajodia S, Noel S, O' Berry B. Topological analysis of network attack vulnerability. in Proceedings of the 2nd ACM symposium on Information, computer and communications security.Singapore.2007.
[51]Michael T. Goodrich and Roberto Tamassia.Data Structures and Algorithms in Java (4th ed.). Wiley.2006.369-418.
[52]Donald E. Knuth.The Art of Computer Programming. vol 4A,7.1.4, Addison-Wesley Professional.2005
[53]Ch. Meinel, T. Theobald.Algorithms and Data Structures in VLSI-Design: OBDD-Foundations and Applications, Springer-Verlag, Berlin, Heidelberg, New York,1998.
[54]CUDD v.2.3.1, Software Ported to Windows,http://Web.cecs.pdx.edu/-alanmi/ research/soft/softPorts.htm.2011-04-24
[55]Matrix TCL Lite. A C++ Matrix Template Class Library for Programmers. http://www.techsoftpl.com/matrix/matlite.htm.2011-04-25
[56]J. M. Caffrey.Automatisation de test ajax. in MSDN magazin.Feb.2007
[57]J. Larson.Testing ajax applications with selenium.in InfoQ magazine,2006.
[58]A. Marchetto, P. Tonella, F. Ricca. State-based testing of ajax Web applications, in Proceedings of the 2008 International Conference on Software Testing, Verification, and Validation.2008.121-130.
[59]郑冬冬,赵朋朋,崔志明Deep Web爬虫研究与设计.清华大学学报(自然科学版).2005年S1期.1896-1902
[60]P. Ipeirotis, L. Gravano. Distributed search over the hidden Web:hierarchical database sampling and selection.in Proceedings of The 28th International Conference on Very Large Databases.Hong Kong.China. August 2002.394-405.
[61]Stephen W. Liddle, David W. Embley, Del T. Scott,et al. Extracting data behind Web forms. Lecture Notes in Computer Science,2003, Volume 2784.
[62]Yao-Wen Huang, Chung-Hung Tsaib, Tsung-Po Lin et al,A testing framework for Web application security assessment,in Computer Networks 48 (2005), 739-761
[63]M. Benedikt, J. Freire, P. Godefroid.VeriWeb:Automatically testing dynamic Web sites.in Proceedings of the 11th International Conference on the World Wide Web, Hono-lulu.2002.
[64]OWASP, WebScarab Project. http://www.owasp.org/Webscarab/.2011-05-01
[65]PAROS. Paros-security tool for web application vulnerability assessment. http://www.parosproxy.org.2011-05-01
[66]Gill, A. Introduction to the Theory of Finite-state Machines. McGraw-Hill, 1962.
[67]Levenshtein VI. Binary codes capable of correcting deletions, insertions, and reversals. Soviet Physics Doklady,1966,10:707-10.
[68]Lawrence A. Cunningham. Language, Deals and Standards:The Future of XML Contracts. Washington University Law Review.2005.
[69]Bergeron, Randy.XPath—Retrieving Nodes from an XML Document.SQL Server Magazine.2000.
[70]WebSPHINX:A Personal, Customizable Web Crawler. http://www.cs.cmu.edu/-rcm/Websphinx/.2011-05-01
[71]JoBo. http://www.matuschek.net/jobo/.2011-05-01
[72]crawler4j. crawler4j-Open Source Web Crawler for Java-Google Project Hosting, http://code.googlc.com/p/crawler4j/.2011-05-01
[73]Larbin Multi-purpose Web crawler.http://larbin.sourceforge.net/index-eng.html. 2011-05-01
[74]Web browser.http://en.wikipedia.org/wiki/Web_browser.2011-05-01
[75]RFC 3986,Uniform Resource Identifier (URI):Generic Syntax, http://labs.apache.org/Webarch/uri/rfc/rfc3986.html.2011-05-01
[76]A. Mesbah,A. van Deursen. Migrating multi-page Web applications to single-page Aj ax interfaces, in Proceedings of the 11th European Conference on Software Maintenance and Reengineering (CSMR'07).2007.181-190.
[77]Depth-first search.http://en.wikipedia.org/wiki/Depth-first_search.2011-05-01
[78]V. L. Levenshtein. Binary codes capable of correcting deletions,insertions, and reversals. Cybernetics and Control Theory,1996.10:707-710,
[79]D. Scott, R. Sharp.Abstracting application-level Web security. in Proceedings of The 11th International Conference on theWorld WideWeb, Honolulu. May 2002,396-407.
[80]M.K. Bergman.The deep Web:surfacing hidden value, Deep Content Whitepaper.2001.
[81]Ari Takanen, Jared D. DeMott, Charles Miller.Fuzzing for Software Security Testing and Quality Assurance,Artech House.2008.
[82]SPIKE. IMMUNITY:Knowing You're Secure. http://www.immunitysec.com/resources-freesoftware.shtml.2011-05-01
[83]Sulley.http://www.fuzzing.org/wp-content/Sulley Fuzzing Framework.exe, 2011-05-01
[84]Scratch.http://packetstormsecurity.org/UNIX/misc/scratch.rar.2011-05-01
[85]S. Raghavan, H. Garcia-Molina.Crawling the hidden Web. in Proceedings of the 27th VLDB Conference.Roma.2001.129-138.
[86]Category:OWASP WebGoat Project.https://www.owasp.org/index.php/. 2011-05-01
[87]Sprajax.http://www.owasp.org/index.php/Category:OWASP_Sprajax_Project. 2011-05-01
[88]Neto Afonso Araujo, Vieira Marco, Madeira Henrique. An Appraisal to Assess the Security of Database Configurations.in Proceedings of 2009 International Conference on Dependability, DEPEND 2009,73-80
[89]Xiaomei Yi, Peng Wu. Security Audit System Using Adaptive Genetic Algorithm and Support Vector Machine, in Proceedings of ICACTE 2010-2010 3rd International Conference on Advanced Computer Theory and Engineering.2010.V3265-V3268.
[90]Niu Honghui,Shang Yanling.Research on risk assessment model of information security based on particle swarm algorithm-RBF neural network. in Proceedings of 2010 2nd Pacific-Asia Conference on Circuits, Communications and System.2010.479-482.
[91]D. Caldwell, A. Gilbert, J. Gottlieb et al. The cutting EDGE of IP router configuration. In Proceedings of ACM HotNets Workshop,2003.
[92]Alcatel-Lucent.7750 SR OS Basic System Configuration Guide,2007.
[93]王升保.信息安全等级保护体系研究及应用.[学位论文],合肥,合肥工业大学,2009
[94]张笑笑,张艳,顾健.等级测评中主机安全配置检查方法研究,全国计算机安全学术交流会论文集·第二十五卷,2010
[95]Lynis.http://www.rootkit.nl/projects/lynis.html.2011-05-01
[96]bastille-unix.http://www.bastille-unix.org/index.html.2011-05-01
[97]MABA. http://www.microsoft.com/china/windowsxp/pro/winxppro/tools/ mbsahome.mspx.2011-05-01
[98]Hubert Zimmermann.OSI Reference Model—The ISO Model of Architecture for Open Systems Interconnection. IEEE Transactions on Communications, vol. 28, no.4, April 1980.425-432
[99]Microsoft Corporation.Update Management Process.2007.http://www.micros oft.com/technet/security/guidance/patchmanagement/secmod 193.mspx. 2011-05-01
[100]Steven Christey,Robert A. Martin. Vulnerability Type Distribution in CVE.2007.
[101]Fortify, A Taxonomy of Coding Errors that Affect Security. https://www.fortify. com/vulncat/en/vulncat/index.html.2011-05-01
[102]XCCDF. http://en.wikipedia.org/wiki/XCCDF.2011-05-01
[103]Federal Desktop Core Configuration (FDCC). http://cit.nih.gov/Support/ FAQ/Fdcc/.2011-05-01
[104]Aho, Alfred V. Algorithms for finding patterns in strings. Handbook of Theoretical Computer Science,.volume A:Algorithms and Complexity. The MIT Press.1990.255-300
[105]Windows Registry,http://en.wikipedia.org/wiki/Windows_Registry. 2011-05-01
[106]Joris Graaumans.Usability of XML Query Languages. SIKS Dissertation Series No 2005-16,2005
[107]G. Cobena, S. Abiteboul, and A. Marian. Detecting changes in XML documents.in Proceedings of IEEE International Conference on Data Engineering (ICDE),2002.41-52
[108]T. Lindholm, J. Kangasharju, S. Tarkoma. Fast and simple XML tree differencing by sequence alignment.in Proceedings of ACM Symposium on Document Engineering ACM,2006.
[109]Y. Wang, D. DeWitt, J.-Y. Cai. X-diff:An effective change detection algorithm for XML documents. In Proceedings of IEEE ICDE,2003.519-530
[110]Diff utils, http://www.gnu.org/software/diffutils/.2011-05-01