Assessment of security protection mechanisms
Our research is aimed at the development of systematic experimental methodologies for the evaluation of the effectiveness of security mechanisms, such as intrusion detection systems (IDS). Our investigation is focused on two main contexts that have become increasingly prone to vulnerabilities: web based applications and Cloud-based infrastructures.
Considering web applications, we have developed a methodology to automatically identify and exploit residual vulnerabilities, based on a black-box approach [AKNA13]. This methodology is also used to generate attack scenarios, including those exploiting several vulnerabilities that may not be independent. These attack scenarios can then be used to assess the effectiveness of IDS that are designed to be able to detect such attacks. A main concern is the exploitation of code injection vulnerabilities, such as SQL injections. To support this methodology, we have developed a new web vulnerability scanner called Wasapy (Web Applications Security Assessment in Python), which has been validated experimentally on typical examples of vulnerable applications [AAAKN11]. Wasapy has also been used to assess the effectiveness of two different IDS techniques developed within the ANR project DALI [LTTNKAAB14].
Our current work is to extend these results to the particular context of Infrastructure-as-a-Service (IaaS) Cloud computing environments. The security mechanisms to assess are the access control means and the intrusion detection and prevention systems that are deployed in the Cloud. Our objective is to conduct automated security evaluations and analyses that are able to give the client a detailed picture of the risks he takes by using the Cloud, and the IaaS provider a good insight into the threats that a client may represent for the infrastructure.
[LTTNKAAB14] R. Ludinard, E. Totel, F. Tronel, V. Nicomette, M. Kaaniche, E. Alata, R. Akrout and Y. Bachy: An Invariant based Approach for Detecting Attacks against Data in Web Applications, International Journal on Secure Software-Engineering, 2014 (To appear)
[AKNA13] E. Alata, M. Kaâniche, V. Nicomette, R. Akrout: An automated vulnerability-based approach for web applications attack scenarios generation, Latin-American Symposium on Dependable Computing (LADC-2013), Rio de Janeiro (Brazil), 2-5 April 2013, pp. 78-85
[AAAKN11] A.Dessiatnikoff, R. Akrout, E. Alata, M. Kaâniche, V. Nicomette: A clustering approach for web vulnerabilities detection, IEEE Pacific Rim International Symposium on Dependable Computing (PRDC 2011), Pasadena (USA), Dec. 2011