Using Feature Selection to Identify Chains of Insecure Software Configuration Parameters
| Autor: | H. Donald Gage, Errin W. Fulp |
|---|---|
| Rok vydání: | 2018 |
| Předmět: |
business.industry
Computer science Evolutionary algorithm Feature selection 0102 computer and information sciences 02 engineering and technology 01 natural sciences Set (abstract data type) Identification (information) Software 010201 computation theory & mathematics Software security assurance Adaptive system 0202 electrical engineering electronic engineering information engineering 020201 artificial intelligence & image processing business Algorithm Software configuration management |
| Zdroj: | TrustCom/BigDataSE |
| Popis: | Configurations provide the ability to adjust the behavior of software for a specific deployment; however, ensuring the configuration yields a functional and secure system can be problematic. Configurations can consist of a large number of parameters to manage and contain unknown parameter interdependencies referred to as a parameter chain. The parameters that compose the parameter chain must be set with respect to each other and this additional complexity makes the identification and resolution difficult for system administrators. This paper introduces an evolutionary-based feature selection technique designed to identify and resolve parameter chains found in software configurations. Given a diverse set of configurations (for the same application), random forests are used to determine the importance of the configuration parameters. These importance values are then clustered to identify the parameters belonging to the parameter chain. Identifying a diverse set of configurations is critical. As a result, an evolutionary algorithm is used to discover configurations that have these characteristics. These processes then repeat until the system has converged on a set of suspected chain parameters. The effectiveness of this approach is analyzed experimentally through a study of Apache configurations that are misconfigured with various types of parameter chains. Experimental results indicate the approach is able to identify and resolve parameter chains that have varying complexity (chain composition and logical structure) and length (number of parameters). |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|