Establishing method and multiplexing method for multiplex attack mode in software security development

Abstract

The invention discloses an establishing method and a multiplexing method for a multiplex attack mode in software security development, wherein the establishing method comprises four key steps: abstraction, matching, modification and instantiation. The multiplexing method comprises the following steps: the descriptive information, the precondition and the post condition of the attack mode are matched; a method applying the attack mode is further judged if the conditions are met; the first class of method applying the attack mode--a multiplexing method directly applying the attack mode is adopted if the function model of a system contains the identical system function for the attack mode; and a second class of method applying the attack mode--a multiplexing method applying the modified attack mode is adopted if the function model of the system contains a similar system function for the attack mode. Compared with the prior art, the multiplexing method of the attack mode improves the efficiency and the accuracy of modeling threatening, so that the software security evaluation and test efficiency of threatening model drive is improved, and the security of a software system is enhanced.

Description

technical field [0001] The invention relates to the technical field of software security, in particular to a method for developing security software based on a unified threat model. Background technique [0002] With the rapid development of the Internet and various Internet-based computer applications, people are more and more dependent on software as the carrier of these applications, and their attention to software security is also increasing. However, the state of software security is not satisfactory. Software is often attacked, resulting in endless computer security incidents, resulting in serious economic losses and loss of reputation. Therefore, how to ensure its security during software development and improve the efficiency of software security evaluation and testing is of great significance to the development of trusted software. [0003] In the process of software security research, many experts have given the paradigm of software security development, and ther...

AI Technical Summary

Problems solved by technology

However, based on structural and semi-structured descriptions of attack modes, better detection of software system security and completeness, and at the same time assisting software security assessment and testing, such methods are rare.

Images