Detecting Vulnerabilities in Service Oriented Architectures

The adoption of Service Oriented Architectures (SOAs) in a wide range of organizations, including business-critical systems, opens the door to new security challenges. Although the services used should be secure and reliable, they are often deployed with security bugs that can be maliciously exploited. The problem is that developers are frequently not specialized on security and the common time-to-market constraints limits an in depth test for vulnerabilities. Additionally, research and practice shows that the effectiveness of existing vulnerability detection tools is very poor. The goal of this work is to advance the state-of-the-art by investigating new techniques and tools to effectively detect vulnerabilities in SOAs in an automated manner. Instrumental in this work is to propose a benchmarking approach that allows assessing and comparing vulnerability detection tools, thus helping guiding tools development and improvement, and allowing users to select the most effective ones according to specific needs.