On Business Logic Vulnerabilities Hunting: The APP_LogGIC Framework

摘要: While considerable research effort has been put in the identification of technical vulnerabilities, such as buffer overflows or SQL injections, business logic vulnerabilities have drawn limited attention. Logic are an important class defects that result faulty application logic. Business refers to requirements implemented algorithms reflect intended functionality application, e.g. online shop a rule could be each cart must register only one discount coupon per product. In our paper, we extend novel heuristic and automated method for detection vulnerabilitieswhich presented previous publication. This detects asserts their criticality Java GUI applications using dynamic analysis static together with fuzzy system order compare rank its findings, minimize false positives negatives. An extensive code ranking is given along empirical results demonstrate potential.