Verifying web applications using bounded model checking

Proceedings of the International Conference on Dependable Systems and Networks

Volumn , Issue , 2004, Pages 199-208

  Huang, Yao Wen ^a,b   Yu, Fang ^b   Hang, Christian ^c   Tsai, Chung Hung ^a   Lee, D T ^a,b   Kuo, Sy Yen ^a  

^a NATIONAL TAIWAN UNIVERSITY   (Taiwan)

^b INSTITUTE OF INFORMATION SCIENCE   (Taiwan)

^c RWTH AACHEN UNIVERSITY   (Germany)

Author keywords

[No Author keywords available]

Indexed keywords

ALGORITHMS; COMPUTER SOFTWARE; ERROR CORRECTION; MATHEMATICAL MODELS; QUALITY ASSURANCE; SECURITY OF DATA; USER INTERFACES;

BOUNDED MODEL CHECKING (BMC); TYPESTATE-BASED (TS) ALGORITHMS; WEB APPLICATIONS;

WORLD WIDE WEB;

EID: 4544358830     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (29)

1. Augustin, L., Dressler, D., Smith, G. "Accelerating Software Development through Collaboration." In Proc. 24th International Conf. Software Engineering, p.559-563, Orlando, Florida, 2002.
2. Ball, T., Naik, M., Rajamani, S. "From Symptom to Cause: Localizing Errors in Counterexample Traces." In Proc. 30th ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages, p.97-105, New Orleans, Louisiana, 2003.
3. Biere, A., Cimatti, A., Clarke, E. M., Fujita, M., Zhu, Y. "Symbolic Model Checking without BDDs." In Proc. 5th Int'l Conf. Tools and Algorithms for Construction and Analysis of Systems, p. 193-207, volume LNCS 1579, Amsterdam, The Netherlands, 1999. Springer-Verlag.
4. Biere, A., Cimatti, A., Clarke, E. M., Fujita, M., Zhu, Y. "Symbolic Model Checking using SAT Procedures instead of BDDs." In Proc. 36th Design Automation Conference, p.317-320, New Orleans, Las Angeles, 1999.
5. Chvatal, V. "A Greedy Heuristic for the Set Covering Problem." Mathematics of Operations Research, 4:33-235, 1979.
6. Clarke, E., Kroening, D., Yorav, k. "Behavioral Consistency of C and Verilog Programs using Bounded Model Checking." Technical Report CMU-CS-03-126, Carnegie Mellon University, School of Computer Science, 2003.
7. Clarke, E., Kroening, D., Yorav, K. "Behavioral Consistency of C and Verilog Programs using Bounded Model Checking." In Proc. 40th Design Automation Conference, Session 23.3, Anaheim, CA, 2003.
8. Clarke, E., Kroening, D. "ANSI-C Bounded Model Checker User Manual." Carnegie Mellon University, School of Computer Science, 2003.
9. Cousot, P., Cousot, R. "Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Constructions or Approximation of Fixpoints." In Conference Record of the 4th ACM Symp. Principles of Programming Languages, p.238-252, 1977.
10. Curphey, M., Endler, D., Hau, W., Taylor, S., Smith, T., Russell, A., McKenna, G., Parke, R., McLaughlin, K., Tranter, N., Klien, A., Groves, D., By-Gad, I., Huseby, S., Eizner, M., McNamara, R. "A Guide to Building Secure Web Applications." The Open Web Application Security Project, v.1.1.1, Sep 2002.
11. Cytron, R., Ferrante, J., Rosen, B. K., Wegman, M. N., Zadeck, F. K. "An Efficient Method of Computing Static Single Assignment Form." In Proc. 16th ACM SIGPLAN-SIGACT Symp. Principles of Programming Languages, p.25-35, Austin, Texas, 1989. ACM Press.
12. Denning, D. E. "A Lattice Model of Secure Information Flow." Communications of the ACM, 19(5):236-243, 1976.
13. Huang, Y. W., Huang, S. K., Lin, T. P., Tsai, C. H. "Web Application Security Assessment by Fault Injection and Behavior Monitoring." In Proc. 12th Int'l World Wide Web Conference, p.148-159, Budapest, Hungary, 2003.
14. Huang, Y. W., Yu, F., Hang, C., Tsai, C. H., Lee, D.T., Kuo, S. Y. "Securing Web Application Code by Static Analysis and Runtime Inspection." In: Proc. 13th Int'l World Wide Web Conference, New York, 2004.
15. Hughes, F. "PHP: Most Popular Server-Side Web Scripting Technology." LWN.net. http://lwn.net/Articles/1433/
16. Kroening, D., Strichman, O. "Efficient Computation of Recurrence Diameters." In Proc. 4th Int'l Conf. Verification, Model Checking, and Abstract Interpretation, p.298-309, volume LNCS 2575, New York, 2003. Springer-Verlag.
17. Meier, J.D., Mackman, A., Vasireddy, S. Dunner, M., Escamilla, R., Murukan, A. "Improving Web Application Security - Threats and Countermeasures." Microsoft Corporation, 2003.
18. Merzbacher, M., Patterson, D. "Measuring End-User Availability on the Web: Practical Experience." In Proc. 2002 Int'l Conf. Dependable Systems and Networks, p.473-488, Washington, D.C., 2002.
19. Moskewicz, M. W., Madigan, C. F., Zhao, Y., Zhang, L., Malik, S. "Chaff: Engineering an Efficient SAT Solver." In Proc. 38th Design Automation Conference, session 33.1, New Orleans, LA, 2001.
20. OWASP. "The Ten Most Critical Web Application Security Vulnerabilities." OWASP Whitepaper, version 1.0, 2003.
21. Pottier, F., Simonet, V. "Information Flow Inference for ML." ACM Transactions on Programming Languages and Systems, 25(1):117-158, 2003.
22. Sandhu, R. S. "Lattice-Based Access Control Models." IEEE Computer, 26(11):9-19, 1993.
23. Sanjit, A. S., Bryant, R. E., "Unbounded, Fully Symbolic Model Checking of Timed Automata using Boolean Methods." In Proc. 15th Int'l Conf. Computer-Aided Verification, p.154-166, volume LNCS 2725, Boulder, Colorado, 2003. Springer-Verlag.
24. Scott, D., Sharp, R. "Abstracting Application-Level Web Security." In Proc. 11th Int'l World Wide Web Conference, p.396-407, Honolulu, Hawaii, 2002.
25. Shankar, U., Talwar, K., Foster, J. S., Wagner, D. "Detecting Format String Vulnerabilities with Type Qualifiers." In Proc. 10th USENIX Security Symposium, p.201-220, Washington DC, 2002.
26. Strom, R. E., Yemini, S. A. "Typestate: A Programming Language Concept for Enhancing Software Reliability." IEEE Transactions on Software Engineering, 12(1):157-171, Jan 1986.
27. Watts, G. "PHPXref: PHP Cross Referencing Documentation Generator." Sep 2003. http://phpxref.sourceforge.net/
28. Woodman, S., Morgan, G., Parkin, S. "Portal Replication for Web Application Availability Via SOAP." In Proc. 8th IEEE Int'l Workshop on Object-Oriented Real-Time Dependable Systems, p. 122-130, Guadalajara, Mexico, 2003.
29. Wright, A. K, Cartwright, R. "A Practical Soft Type System for Scheme." ACM Transactions on Programming Languages and Systems, 19(1):87-152, Jan 1999.