In recent years, fuzz testing has established itself as a reliable and indispensable testing method for finding previously unknown and product specific vulnerabilities within the code base of automotive systems. As such, we see increased requirements for automotive products that call for fuzz testing per default. Based on the semidecidable characteristic for finding fuzz testing results, i.e., virtually an infinite test space, it is a non-trivial task to generate plausible evidence that sufficient fuzz testing has been applied to the target system. In this paper, starting from fuzz test result generation, we specify the individual steps necessary for preparing a sound evidence report. We describe how evidence is created in this context and which information is relevant. The traceability of fuzz testing product requirements is a driving factor thereby. We also analyze how useful Cybersecurity Assurance Levels (CAL) are in this process and how quantitative as well as qualitative metrics can be utilized as evidence. Finally, we discuss the conclusiveness of various fuzz testing evidence types and show the limits of evidence generation of this testing method. Our approach allows owners of security-relevant systems to provide evidence to customers or authorities showing that there was, based on a systematic risk-based methodology, sufficient fuzz testing conducted on the target system. Moreover, this approach brings the additional benefits of allowing more proven test diversification of the product, thereby reducing the effort on expensive manual testing methods like penetration testing and allowing more sophisticated overall test reporting of the product.


    Zugriff

    Zugriff prüfen

    Verfügbarkeit in meiner Bibliothek prüfen

    Bestellung bei Subito €


    Exportieren, teilen und zitieren



    Titel :

    Processing Fuzz Testing Results into an Evidence Report


    Weitere Titelangaben:

    Sae Technical Papers


    Beteiligte:
    Oka, Dennis Kengo (Autor:in) / Vinzenz, Nico (Autor:in)

    Kongress:

    WCX SAE World Congress Experience ; 2023



    Erscheinungsdatum :

    2023-04-11




    Medientyp :

    Aufsatz (Konferenz)


    Format :

    Print


    Sprache :

    Englisch




    Integrating Fuzz Testing into the Cybersecurity Validation Strategy

    Oka, Dennis Kengo / Vinzenz, Nico | SAE Technical Papers | 2021


    Integrating Fuzz Testing into the Cybersecurity Validation Strategy

    Vinzenz, Nico / Oka, Dennis Kengo | British Library Conference Proceedings | 2021


    Integrating Fuzz Testing into a CI Pipeline for Automotive Systems

    Oka, Dennis Kengo / Vinzenz, Nico | British Library Conference Proceedings | 2022


    Integrating Fuzz Testing into a CI Pipeline for Automotive Systems

    Oka, Dennis Kengo / Vinzenz, Nico | British Library Conference Proceedings | 2022


    Integrating Fuzz Testing into a CI Pipeline for Automotive Systems

    Oka, Dennis Kengo / Vinzenz, Nico | SAE Technical Papers | 2022