A Fault-Driven Combinatorial Process for Model Evolution in XSS Vulnerability Detection

  • Bernhard Garn
  • Marco RadavelliEmail author
  • Angelo Gargantini
  • Manuel Leithner
  • Dimitris E. Simos
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11606)


We consider the case where a knowledge base consists of interactions among parameter values in an input parameter model for web application security testing. The input model gives rise to attack strings to be used for exploiting XSS vulnerabilities, a critical threat towards the security of web applications. Testing results are then annotated with a vulnerability triggering or non-triggering classification, and such security knowledge findings are added back to the knowledge base, making the resulting attack capabilities superior for newly requested input models. We present our approach as an iterative process that evolves an input model for security testing. Empirical evaluation on six real-world web application shows that the process effectively evolves a knowledge base for XSS vulnerability detection, achieving on average 78.8% accuracy.


Combinatorial testing XSS vulnerability Security testing Model evolution 


  1. 1.
    Arcaini, P., Gargantini, A., Radavelli, M.: Efficient and guaranteed detection of t-way failure-inducing combinations. In: IEEE International Conference on Software Testing, Verification and Validation ICST Workshops (2019)Google Scholar
  2. 2.
    Bozic, J., Garn, B., Kapsalis, I., Simos, D., Winkler, S., Wotawa, F.: Attack pattern-based combinatorial testing with constraints for web security testing. In: IEEE International Conference on Software Quality, Reliability and Security (2015)Google Scholar
  3. 3.
    Catteddu, D.: Cloud computing: benefits, risks and recommendations for information security. In: Serrão, C., Aguilera Díaz, V., Cerullo, F. (eds.) IBWAS 2009. CCIS, vol. 72, pp. 17–17. Springer, Heidelberg (2010). Scholar
  4. 4.
    Duchene, F., Groz, R., Rawat, S., Richier, J.-L.: XSS vulnerability detection using model inference assisted evolutionary fuzzing. In IEEE International Conference on Software Testing, Verification and Validation (ICST), pp. 815–817 (2012)Google Scholar
  5. 5.
    O. Foundation: OWASP Top 10 2017. Accessed 19 Apr 2018
  6. 6.
    Gargantini, A., Petke, J., Radavelli, M.: Combinatorial interaction testing for automated constraint repair. In: IEEE International Confernce on Software Testing, Verification and Validation ICST Workshops, pp. 239–248 (2017)Google Scholar
  7. 7.
    Gargantini, A., Radavelli, M.: Migrating combinatorial interaction test modeling and generation to the web. In: IEEE International Conference on Software Testing, Verification and Validation ICST Workshops, pp. 308–317 (2018)Google Scholar
  8. 8.
    Garn, B., Kapsalis, I., Simos, D.E., Winkler, S.: On the applicability of combinatorial testing to web application security testing: a case study. In: Proceedings of the 2014 Workshop on Joining AcadeMiA and Industry Contributions to Test Automation and Model-Based Testing, pp. 16–21. ACM (2014)Google Scholar
  9. 9.
    Ghandehari, L.S., Lei, Y., Kacker, R., Kuhn, D.R.R., Kung, D., Xie, T.: A combinatorial testing-based approach to fault localization. IEEE Trans. Softw. Eng. (2018)Google Scholar
  10. 10.
    Jia, Y., Cohen, M.B., Harman, M., Petke, J.: Learning combinatorial interaction test generation strategies using hyperheuristic search. In: Proceedings of the International Conference on Software Engineering - Volume 1, ICSE 2015, pp. 540–550 (2015)Google Scholar
  11. 11.
    Kuhn, D., Kacker, R., Lei, Y.: Introduction to Combinatorial Testing. Chapman & Hall/CRC, London (2013)zbMATHGoogle Scholar
  12. 12.
    Melicher, W., Das, A., Sharif, M., Bauer, L., Jia, L.: Riding out DOMsday: towards detecting and preventing DOM cross-site scripting. In: Proceedings of Network and Distributed System Security Symposium. Internet Society (2018)Google Scholar
  13. 13.
    Simos, D.E., Kleine, K., Ghandehari, L.S.G., Garn, B., Lei, Y.: A combinatorial approach to analyzing cross-site scripting (XSS) vulnerabilities in web application security testing. In: Wotawa, F., Nica, M., Kushik, N. (eds.) ICTSS 2016. LNCS, vol. 9976, pp. 70–85. Springer, Cham (2016). Scholar
  14. 14.
    Simos, D.E., Kuhn, R., Voyiatzis, A.G., Kacker, R.: Combinatorial methods in security testing. IEEE Comput. 49, 40–43 (2016)CrossRefGoogle Scholar
  15. 15.
    Temple, P., Galindo, J.A., Acher, M., Jézéquel, J.-M.: Using machine learning to infer constraints for product lines. In: Proceedings of the 20th International Systems and Software Product Line Conference, pp. 209–218. ACM (2016)Google Scholar
  16. 16.
    Yu, L., Lei, Y., Kacker, R.N., Kuhn, D.R.: ACTS: a combinatorial test generation tool. In: IEEE International Conference on Software Testing, Verification and Validation (2013)Google Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  • Bernhard Garn
    • 1
  • Marco Radavelli
    • 2
    Email author
  • Angelo Gargantini
    • 2
  • Manuel Leithner
    • 1
  • Dimitris E. Simos
    • 1
  1. 1.SBA ResearchViennaAustria
  2. 2.University of BergamoBergamoItaly

Personalised recommendations