宁可事先谨慎，不可事后后悔！功能破坏性安全配置规则的自动化识别
Better Safe Than Sorry! Automated Identification of Functionality-Breaking Security-Configuration Rules
AI总结：
本文提出一种结合组合测试与机器学习的方法，自动化识别安全配置中会破坏系统功能的规则，使管理员能在不损害功能的前提下安全加固系统。
摘要：
软件设置中的不安全默认值可能会被攻击者利用，从而危害运行该软件的系统。作为一种对策，现有的安全配置指南详细规定了哪些值是安全的。然而，大多数管理员仍不愿对现有系统进行加固，因为他们担心应用安全设置会导致系统功能退化。为了促进安全配置指南的应用，有必要识别出那些会限制功能的规则。本文提出了一种方法，使用组合测试来发现规则的问题组合，并利用机器学习技术来识别这些组合中的问题规则。管理员随后可以仅应用无问题的规则，从而在不破坏系统功能风险的情况下提高系统的安全性。为了证明该方法的有效性，我们将其应用于从与Siemens管理员的讨论中提取的实际问题中，并在这些案例中找到了问题规则。我们希望该方法及其开源实现能够激励更多管理员对其系统进行加固，从而提高其系统的整体安全性。
英文摘要：
Insecure default values in software settings can be exploited by attackers to compromise the system that runs the software. As a countermeasure, there exist security-configuration guides specifying in detail which values are secure. However, most administrators still refrain from hardening existing systems because the system functionality is feared to deteriorate if secure settings are applied. To foster the application of security-configuration guides, it is necessary to identify those rules that would restrict the functionality. This article presents our approach to use combinatorial testing to find problematic combinations of rules and machine learning techniques to identify the problematic rules within these combinations. The administrators can then apply only the unproblematic rules and, therefore, increase the system's security without the risk of disrupting its functionality. To demonstrate the usefulness of our approach, we applied it to real-world problems drawn from discussions with administrators at Siemens and found the problematic rules in these cases. We hope that this approach and its open-source implementation motivate more administrators to harden their systems and, thus, increase their systems' general security.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
