Architecture for automated detection and analysis of security issues

• US 7,594,142 B1
• Filed: 06/30/2006
• Issued: 09/22/2009
• Est. Priority Date: 06/30/2006
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: O'Leary, Arthur J, Fly, Robert C
• Primary Examiner(s): Maskulinski; Michael C
• Application Number:
  US11/427,923
• Time in Patent Office: 1,180 Days
• Field of Search: 714/38
• US Class Current: 714/38.11
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Systems, methods, and/or techniques (“tools”) that relate to an architecture for automated detection and analysis of security issues are described herein. One aspect of the tools provides a watchdog application that generates fizzing signals that enable or disable fuzzing of test cases that are to be received by the watchdog application. The watchdog application also receives notifications of test cases that are to be executed on a system under test with which the watchdog application is associated. Finally, the watchdog application monitors the system under test when it is executing the test case.

Claims

1. A method implemented at least in part by a computing device comprising:

disabling fuzzing for at least one test case to be run against at least one system under test;

receiving at least one notification of at least one non-fuzzed test case to be run against the system under test;

establishing a baseline profile indicating performance of the system under test when processing the non-fuzzed test case;

enabling fuzzing for at least one fuzzed test case to be run against the system under test;

receiving notification of the fuzzed test case;

running at least one fuzzed test case against the system under test;

monitoring the system under test when the system under test is processing the fuzzed test case;

monitoring the system under test for one or more security flaws;

detecting whether the system under test contains one or more security flaws; and

in response to the detection of one or more security flaws, assigning a criticality level to the one or more security flaws.

2. The method of claim 1, further comprising generating handling events based on the criticality level of the one or more security flaws in the system under test.

3. The method of claim 1, further comprising generating a fuzzed test case based on the one or more detected security flaws.

4. The method of claim 3, further comprising selecting the fuzzed test case to be run against the system under test based on the one or more detected security flaws.

5. The method of claim 1, further comprising correlating performance of the system under test when processing the fuzzed test case to a notification of the fuzzed test case.

6. The method of claim 5, further comprising evaluating whether the performance of the system under test deviates from a baseline performance profile associated with the system under test.

7. The method of claim 1, further comprising reporting a deviation from a baseline performance profile associated with the system under test.

8. The method of claim 1, further comprising reporting that the system under test successfully processed the fuzzed test case.

9. A method implemented at least in part by a computing device comprising:

enabling fuzzing for at least one fuzzed test case to be run against a system under test;

receiving notification of the fuzzed test case;

running at least one fuzzed test case against the system under test;

correlating performance of the system under test when processing the fuzzed test case to the notification of the fuzzed test case;

monitoring the system under test when the system under test is processing the fuzzed test case;

capturing system statistics from the system under test at a beginning of a test case;

capturing system statistics from the system under test while processing the test case;

capturing system statistics from the system under test at an end of the test case; and

evaluating the system statistics.

10. The method of claim 9, further comprising based on the evaluation of system statistics, detecting potential bugs in the system under test;

and

categorizing the potential bugs.

11. The method of claim 9, further comprising evaluating whether the performance of the system under test deviates from a baseline performance profile associated with the system under test.

12. The method of claim 9, further comprising reporting a deviation from a baseline performance profile associated with the system under test.

13. The method of claim 9, further comprising reporting that the system under test successfully processed the fuzzed test case.

14. One or more computer-readable media having computer-readable instructions therein that, when executed by a computing device, cause the computing device to perform acts comprising:

generating at least one fuzzing signal that enables or disables fuzzing of test cases to be received by a watchdog application;

receiving at least one notification of at least one test case that is to be executed on a system under test that is associated with the watchdog application;

monitoring the system under test when executing the test case;

establishing a baseline performance profile for the system under test;

reporting a deviation from the baseline performance profile; and

wherein the act of reporting a deviation includes reporting at least one of the following;

writing of personally identifiable information by the system under test;

excessive write operations performed by the system under test;

a successful local cross site scripting attack on the system under test; and

unauthorized directory accesses by the system under test.

15. The computer-readable media of claim 14, wherein the acts further comprise correlating results of executing the test case with the notification of the test case.

16. The computer-readable media of claim 14, wherein the acts further comprise determining whether execution of the test case on the system under test results in any deviation from a baseline performance profile associated with the system under test.

17. The computer-readable media of claim 14, wherein the act of reporting a deviation includes reporting the deviation to a watchdog kernel component.