Automated Fault Localization of XACML Policies

Access control policies in distributed systems, particularly implemented in the XACML standard language, are increasingly complex. Faults may exist in complex policies for various reasons such as misunderstanding of the access control requirements, omissions, and coding errors. These faults, if not removed before deployment, may lead to unauthorized accesses or denial of service. Manual localization of these faults, however, can be a challenging task. Inspired by spectrum-based fault localization for software debugging, this paper presents an approach for automatically localizing the fault(s) in a given XACML policy by exploring test coverage information of the policy elements. We investigate two test coverage criteria (i.e., reachability and firing) of policy elements and 14 scoring methods for ranking policy elements to determine the fault location(s). To evaluate the fault localization methods, we have used real-world policy files with different levels of complexity and a large number of policy mutants with one or two seeded faults. The experiment results show that the firing-based Naish2 and CBI-Inc methods are effective in fault localization of XACML policies.

[1]  Tao Xie,et al.  Automated Test Generation for Access Control Policies via Change-Impact Analysis , 2007, Third International Workshop on Software Engineering for Secure Systems (SESS'07: ICSE Workshops 2007).

[2]  Richard J. Lipton,et al.  Hints on Test Data Selection: Help for the Practicing Programmer , 1978, Computer.

[3]  Baowen Xu,et al.  A theoretical analysis of the risk evaluation formulas for spectrum-based fault localization , 2013, TSEM.

[4]  Yuen-Tak Yu,et al.  Extending the Theoretical Fault Localization Effectiveness Hierarchy with Empirical Results at Different Code Abstraction Levels , 2014, 2014 IEEE 38th Annual Computer Software and Applications Conference.

[5]  Lee Naish,et al.  A model for spectra-based software diagnosis , 2011, TSEM.

[6]  Lionel C. Briand,et al.  Is mutation an appropriate tool for testing experiments? , 2005, ICSE.

[7]  Peter Zoeteweij,et al.  Spectrum-Based Multiple Fault Localization , 2009, 2009 IEEE/ACM International Conference on Automated Software Engineering.

[8]  Tao Xie,et al.  First step towards automatic correction of firewall policy faults , 2012, TAAS.

[9]  Tao Xie,et al.  A fault model and mutation testing of access control policies , 2007, WWW '07.

[10]  Mary Jean Harrold,et al.  Empirical evaluation of the tarantula automatic fault-localization technique , 2005, ASE.

[11]  A. Jefferson Offutt,et al.  Investigations of the software testing coupling effect , 1992, TSEM.

[12]  Raúl A. Santelices,et al.  Lightweight fault-localization using multiple coverage types , 2009, 2009 IEEE 31st International Conference on Software Engineering.

[13]  Lionel C. Briand,et al.  Using Machine Learning to Support Debugging with Tarantula , 2007, The 18th IEEE International Symposium on Software Reliability (ISSRE '07).

[14]  Guanling Chen,et al.  Automatic XACML requests generation for testing access control policies , 2014, SEKE.

[15]  Peter Zoeteweij,et al.  A practical evaluation of spectrum-based fault localization , 2009, J. Syst. Softw..

[16]  Francesca Lonetti,et al.  Automatic XACML Requests Generation for Policy Testing , 2012, 2012 IEEE Fifth International Conference on Software Testing, Verification and Validation.

[17]  Michael D. Ernst,et al.  Are mutants a valid substitute for real faults in software testing? , 2014, SIGSOFT FSE.

[18]  Michael Carl Tschantz,et al.  Verification and change-impact analysis of access-control policies , 2005, Proceedings. 27th International Conference on Software Engineering, 2005. ICSE 2005..

[19]  Yuriy Brun,et al.  Finding latent code errors via machine learning over program executions , 2004, Proceedings. 26th International Conference on Software Engineering.

[20]  Tao Xie,et al.  Fault Localization for Firewall Policies , 2009, 2009 28th IEEE International Symposium on Reliable Distributed Systems.

[21]  Dianxiang Xu,et al.  Fault-Based Testing of Combining Algorithms in XACML3.0 Policies , 2015, SEKE.

[22]  David Lo,et al.  Search-based fault localization , 2011, 2011 26th IEEE/ACM International Conference on Automated Software Engineering (ASE 2011).

[23]  Hoyt Lougee,et al.  SOFTWARE CONSIDERATIONS IN AIRBORNE SYSTEMS AND EQUIPMENT CERTIFICATION , 2001 .

[24]  Francesca Lonetti,et al.  The X-CREATE Framework - A Comparison of XACML Policy Testing Strategies , 2012, WEBIST.

[25]  Robert M. Marmorstein,et al.  Assisted Firewall Policy Repair Using Examples and History , 2007, LISA.

[26]  Byoungju Choi,et al.  A family of code coverage-based heuristics for effective fault localization , 2010, J. Syst. Softw..

[27]  Yan Shi,et al.  Using an RBF Neural Network to Locate Program Bugs , 2008, 2008 19th International Symposium on Software Reliability Engineering (ISSRE).

[28]  David Lo,et al.  Fusion fault localizers , 2014, ASE.

[29]  Rui Abreu,et al.  Diagnosing multiple intermittent failures using maximum likelihood estimation , 2010, Artif. Intell..