Design and User Study of a Constraint-based Framework for Business Logic Flaw Discovery

Abstract

Business logic flaws are common in web application security and pose a huge problem to developers. While there are many tools that check application code for implementation-level vulnerabilities, they are often blind to flaws caused by violation of design-level considerations. In this work, we present a framework that guides developers to create security test scenarios or misuse case scenarios by relating design constraints to existing functional use case scenarios. Those design constraints can then be translated into misuse case scenarios which can be run using existing test code that were written for functional use case scenarios in order to discover potential business logic flaws. In this paper, we conduct a user study with eleven experienced programmers to determine the feasibility of our approach and compare the complexity of our framework to the conventional approach of creating misuse case scenarios from scratch. The results of that study show that our framework saves time, improves coverage, and enhances re-usability compared to the conventional approach of creating misuse case scenarios in an ad-hoc manner.