Automatic Verification of a Remote Code Execution Vulnerability Detection Model Using the SPIN Model Checker

Abstract

Communicating and delivering services to the consumers through web applications are now become very popular because of easily wide range information support and integration of data with other applications. Absolute coding practices during the programming and lack of security awareness are the main cause of various types of vulnerabilities at the application level in the World Wide Web (WWW) system. Cyber Attacks are becoming a critical risk for every digital transformation around the world. One of the biggest weaknesses in this area is remote code execution (RCE). According to the Web Application Security Project (CWE / SANS), RCE is on the list of sensitive critical applications that have been vulnerable since 2016. Objective: This paper proposes a model, and verify using SPIN model checker. Results: This research also simulates the proposed model with automata called finite state machines and exhibits it as a finite model. Conclusions: Various types of case studies and detection models are introduced and compared with other vulnerability detection model. After reviewing literatures, we found insignificant researches conducted on justifying web layer vulnerability detection model using SPIN model.