A Weakness-Based Attack Pattern Modeling and Relational Analysis Method

With growing popularity of online services, the amount of information on web increases dramatically, which has resulted in increasingly concerns on web application security. Subject knowledge is in desperate need to guide security testing against advanced attacks. Unlike common software security weakness study pattern, a combination analysis method based on Colored Petri Net is presented in this paper. An Attack Pattern is modeled to describe a single weakness's specific exploiting process. Then attack nets are constructed as a result of their relational analysis. The method is verified by a case study.