基于消息变异的Web服务脆弱性测试系统的设计与实现
esign and Implementation of Web Service Vulnerability Testing System Based on SOAP Messages Mutation
研制自动化的Web服务脆弱性测试工具对基于Web服务的软件工程有重大影响，并能提高软件的安全性和可靠性，是当前软件行业一个有意义的研究课题。针对广泛使用的Web服务设计和实现了一个测试Web服务脆弱性原型系统WSVTS (Web Service Vulnerability Testing System)。根据SOAP消息参数的个数和类型，实现了两种基于SOAP消息变异的Web服务脆弱性测试方法，分别是最坏差异输入变异方法(The Worst-input Mutation Approach)和杂乱数据变异方法(Fuzz Data-input Mutation Approach)。测试系统融合这两种测试方法，实现了两种测试用例生成算法，分别是最远邻测试用例生成算法TCFN(Test Cases generation based on Farthest Neighbor)和杂乱数据输入变异算法FDMA(Fuzz Data-input Mutation Algorithm) ，然后，将算法产生的测试用例作用于SOAP请求消息，从客户端观察应答消息，来分析Web服务的脆弱性。
he automatic tool of testing Web Service vulnerability brings great effect on web service-based software engineering,and they can effectively ensure the security and reliability of web service-based software.According to Web service used widespread,a prototype system WSVTS(Web Service Vulnerability Testing System) is designed and implemented. Two mutation approaches of testing web service vulnerability based on the input domain of SOAP message are implemented, namely, the worst-input mutation approach and fuzz data-input mutation approach. Based on the two approaches, two test cases generation algorithms which are Test Cases generation based on Farthest Neighbor (TCFN) and Fuzz Data-input Mutation Algorithm (FDMA) are also implemented.Then, the test cases generated by the algorithms are executed in the SOAP requesting message and the vulnerability of the Web services can be detected by the response message of the client.
李青、陈加梅、陈锦富、王环环、詹永照
计算技术、计算机技术
Web服务soap消息脆弱性测试测试用例变异算子原型系统
Web serviceSOAP messagesvulnerability testingtest casesmutation operatorsprototype system
李青,陈加梅,陈锦富,王环环,詹永照.基于消息变异的Web服务脆弱性测试系统的设计与实现[EB/OL].(2013-04-27)[2025-08-16].http://www.paper.edu.cn/releasepaper/content/201304-544.点此复制
评论