On the value of hybrid security testing

Abstract

We propose a framework for designing a security tool that can take advantages from current approaches while increasing precision, scalability and debuggability. This could enable software developers to conduct comprehensive security testing automatically. The approaches we utilise are static, dynamic and taint analysis along with fuzzing. The rationale behind this is that the complexity of today’s applications makes the discovery of their vulnerabilities difficult using a single approach. Therefore, a combination of them is what is needed to move towards efficient security checking.