Generating attack scenarios for the system security validation

Abstract

Next Generation Network (NGN) is a completely new architectural concept for providing end-users with voice, video, and all sorts of data services. However, secure communication is a key and challenging requirement for NGN service providers. In this paper, we propose an innovative attack script generation and injection approach to evaluate the security of the communication system and consequently detect its security flaws. We apply attack modeling technique to describe the system vulnerabilities and generate system context attack scenarios. The attack scenarios are then refined to executable attack scripts which are executed by communication testing tools in charge of emulating the system attacks. The approach is applied to Wireless Application Protocol (WAP), which is a customized protocol used in resource constrained mobile devices. We performed experiments using specific attacks of the mobile protocol such as Denial of Service (DoS) and Message Truncation attacks. The experiments results demonstrate the effectiveness of the attack injection approach in the role of detecting security vulnerabilities in the communication system.