• 主题
高级搜索  >
历史搜索 清空历史
首页> 外文会议>Software Engineering for Secure Systems, 2009. SESS '09 >A hybrid analysis framework for detecting web application vulnerabilities
【24h】

A hybrid analysis framework for detecting web application vulnerabilities

机译：用于检测Web应用程序漏洞的混合分析框架

获取原文
页面导航
  • 摘要
  • 著录项
  • 相似文献
  • 相关主题

摘要

Increasingly, web applications handle sensitive data and interface with critical back-end components, but are often written by poorly experienced programmers with low security skills. The majority of vulnerabilities that affect web applications can be ascribed to the lack of proper validation of user's input, before it is used as argument of an output function. Several program analysis techniques were proposed to automatically spot these vulnerabilities. One particularly effective is dynamic taint analysis. Unfortunately, this approach introduces a significant run-time penalty. In this paper, we present a hybrid analysis framework that blends together the strengths of static and dynamic approaches for the detection of vulnerabilities in web applications: a static analysis, performed just once, is used to reduce the run-time overhead of the dynamic monitoring phase. We designed and implemented a tool, called Phan, that is able to statically analyze PHP bytecode searching for dangerous code statements; then, only these statements are monitored during the dynamic analysis phase.
机译：Web应用程序越来越多地处理敏感数据并与关键的后端组件进行接口，但是通常由经验不足且安全技能较低的程序员编写。影响Web应用程序的大多数漏洞都可以归因于在用作输出函数的参数之前，对用户输入的正确验证不足。提出了几种程序分析技术来自动发现这些漏洞。一种特别有效的方法是动态污染分析。不幸的是，这种方法引入了显着的运行时间损失。在本文中，我们提供了一个混合分析框架，该框架将静态和动态方法的优势融合在一起，可用于检测Web应用程序中的漏洞：仅执行一次静态分析即可减少动态监控的运行时开销相。我们设计并实现了一个名为Phan的工具，该工具能够静态分析PHP字节码搜索危险代码语句。然后，在动态分析阶段仅监视这些语句。

著录项

相似文献

  • 外文文献
  • 中文文献
  • 专利
获取原文

客服邮箱：kefu@zhangqiaokeyan.com

京公网安备：11010802029741号 ICP备案号：京ICP备15016152号-6 六维联合信息科技 (北京) 有限公司©版权所有

  • 客服微信

  • 服务号