Finding security vulnerabilities in java applications with static analysis
作者： V. Benjamin Livshits , Monica S. Lam
DOI:
关键词:
摘要: This paper proposes a static analysis technique for detecting many recently discovered application vulnerabilities such as SQL injections, cross-site scripting, and HTTP splitting attacks. These stem from unchecked input, which is widely recognized the most common source of security in Web applications. We propose approach based on scalable precise points-to analysis. In our system, user-provided specifications are automatically translated into analyzers. Our finds all matching specification statically analyzed code. Results presented to user assessment an auditing interface integrated within Eclipse, popular Java development environment. Our found 29 nine large, open-source applications, with two residing widely-used libraries. fact, but one benchmark suite had at least vulnerability. Context sensitivity, combined improved object naming, proved instrumental keeping number false positives low. yielded very few experiments: only benchmarks suffered alarms.
stanford.edu
acm.org 参考文章(37)
Amit Klein, Cross Site Scripting Explained ,(2002)
Chris Anley, Advanced SQL Injection In SQL Server Applications ,(2002)
Mike Shema, David Wong, Joel Scambray, Hacking Exposed Web Applications: Web Application Security Secrets & Solutions Osborne/McGraw-Hill. ,(2002)
David Litchfield, None, SQL Server Security ,(2003)
Rob Johnson, David Wagner, Finding user/kernel pointer bugs with type inference usenix security symposium. pp. 9- 9 ,(2004)
Amit Klein, Hacking Web Applications Using Cookie Poisoning ,(2002)
David Leblanc, Brian Valentine, Michael Howard, Writing Secure Code ,(2001)
Steve Freeman, Tim Mackinnon, Philip Craig, Endo-testing: unit testing with mock objects Extreme programming examined. pp. 287- 301 ,(2001)
Susann Ragsdale, Jim S. Miller, The Common Language Infrastructure Annotated Standard ,(2003)
David Wagner, Kunal Talwar, Jeffrey S. Foster, Umesh Shankar, Detecting format string vulnerabilities with type qualifiers usenix security symposium. pp. 16- 16 ,(2001)