A hybrid analysis framework for detecting web application vulnerabilities

Proceedings of the 2009 ICSE Workshop on Software Engineering for Secure Systems, SESS 2009

Volumn , Issue , 2009, Pages 25-32

  Monga, Mattia ^a   Paleari, Roberto ^a   Passerini, Emanuele ^a  

^a UNIVERSITY OF MILAN   (Italy)

Author keywords

[No Author keywords available]

Indexed keywords

BYTECODES; DYNAMIC MONITORING; HYBRID ANALYSIS; OUTPUT FUNCTIONS; PROGRAM ANALYSIS; RUNTIMES; SENSITIVE DATAS; STATIC AND DYNAMIC APPROACH; WEB APPLICATION; WEB APPLICATION VULNERABILITY;

COMPUTER SOFTWARE; PHASE INTERFACES; WORLD WIDE WEB;

DYNAMIC ANALYSIS;

EID: 70349923612     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/IWSESS.2009.5068455     Document Type: Conference Paper

References (20)

1. A. V. Aho, R. Sethi, and J. D. Ullman. Compilers, Principles, Techniques, and Tools. Addison-Wesley, 1986.
2. F. E. Allen. Control Flow Analysis. SIGPLAN Notices, 5, 1970.
3. D. Balzarotti, M. Cova, V. Felmetsger, N. Jovanovic, E. Kirda, C. Kruegel, and G. Vigna. Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications. In Proceedings of the IEEE Symposium on Security and Privacy, Oakland, CA, May 2008.
4. CERT. Advisory CA-2000-02: Malicious HTML Tags Embedded in Client Web Requests, 2002.
5. M. Cova, V. Felmetsger, and G. Vigna. Vulnerability Analysis of Web Applications. In L. Baresi and E. Di Nitto, editors, Testing and Analysis of Web Services. Springer, 2007.
6. M. D. Ernst. Static and Dynamic Analysis: Synergy and Duality. In WODA 2003: ICSE Workshop on Dynamic Analysis, Portland, OR, May 9, 2003.
7. A. Futoransky, E. Gutesman, and A. Waissbein. A dynamic technique for enhancing the security and privacy of web applications. In Black Hat USA, 2007.
8. W. G. Halfond, J. Viegas, and A. Orso. A Classification of SQL-Injection Attacks and Countermeasures. In Proceedings of the IEEE International Symposium on Secure Software Engineering, Arlington, VA, USA, March 2006.
9. S. Horwitz, T. Reps, and D. Binkley. Interprocedural Slicing Using Dependence Graphs. In PLDI '88: Proceedings of the ACM SIGPLAN 1988 conference on Programming Language design and Implementation, New York, NY, USA, 1988. ACM Press.
10. Y.-W. Huang, F. Yu, C. Hang, C.-H. Tsai, D.-T. Lee, and S.-Y. Kuo. Securing web application code by static analysis and runtime protection. In Proceedings of the 13th international conference on World Wide Web. ACM, 2004.
11. N. Jovanovic, C. Kruegel, and E. Kirda. Precise alias analysis for static detection of web application vulnerabilities. In Proceedings of the 2006 workshop on Programming languages and analysis for security, New York, NY, USA, 2006. ACM.
12. N. Jovanovic, C. Krügel, and E. Kirda. Pixy: A static analysis tool for detecting web application vulnerabilities (short paper). In IEEE Symposium on Security and Privacy. IEEE Computer Society, 2006.
13. A. Nguyen-tuong, S. Guarnieri, D. Greene, J. Shirley, and D. Evans. Automatically hardening web applications using precise tainting. In In 20th IFIP International Information Security Conference, 2005.
14. F. Nielson, H. R. Nielson, and C. L. Hankin. Principles of Program Analysis. Springer-Verlag, 1999.
15. Perl documentation. perlsec. http://perldoc.perl.org/perlsec.html.
16. T. Pietraszek and C. V. Berghe. Defending against injection attacks through context-sensitive string evaluation. In In Recent Advances in Intrusion Detection (RAID), 2005.
17. Symantec Inc. Symantec internet security threat report: Volume XIII. Technical report, Symantec Inc., apr 2008.
18. G. Wassermann and Z. Su. Sound and precise analysis of web applications for injection vulnerabilities. In Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation, New York, NY, USA, 2007. ACM.
19. M. Weiser. Program slicing. In ICSE '81: Proceedings of the 5th International Conference on Software engineering, Piscataway, NJ, USA, 1981. IEEE Press.
20. Y. Xie and A. Aiken. Static detection of security vulnerabilities in scripting languages. In Proceedings of the 15th conference on USENIX Security Symposium, Berkeley, CA, USA, 2006. USENIX Association.