Using dynamic information flow analysis to detect attacks against applications

SESS 2005 - Proceedings of the 2005 Workshop on Software Engineering for Secure Systems - Building Trustworthy Applications

Volumn , Issue , 2005, Pages

  Masri, Wes ^a   Podgurski, Andy ^b  

^a AMERICAN UNIVERSITY OF BEIRUT   (Lebanon)

^b Case Western Reserve University   (United States)

Author keywords

Dynamic information flow analysis; Intrusion detection; Observation based testing; Program dependences

Indexed keywords

CLUSTER ANALYSIS; INFORMATION DISSEMINATION; INFORMATION USE; INTRUSION DETECTION; SOFTWARE TESTING;

CASE-STUDIES; DYNAMIC INFORMATION FLOW ANALYSIS; INFORMATION FLOW POLICIES; INFORMATION FLOWS; JAVA BYTE CODE PROGRAMS; NEW APPROACHES; PROGRAM DEPENDENCE; PROTOTYPE TOOLS;

APPLICATION PROGRAMS;

EID: 85085405276     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1083200.1083216     Document Type: Conference Paper

References (31)

1. Brown, J. and Knight, T. A Minimal Trusted Computing Base for Dynamically Ensuring Secure Information Flow. Project Aries TM-015 (November 2001).
2. Denning D. E. A Lattice Model of Secure Information Flow. Comm. ACM, Vol. 19, No. 5 (May 1976), 236-242.
3. Denning D.E. and Denning P.J. Certification of programs for secure information flow. Communication of the ACM 20, 7 (1977), 504-513.
4. Denning, D.E. Secure information flow in computer systems. Ph.D. Thesis, Computer Science Dept., Purdue U., W. Lafayette, Ind., May 1975.
5. Denning, D.E. An intrusion detection model. IEEE Transactions on Software Engineering, Vol. 13, No. 2 (February, 1987), 222-232.
6. Dickinson, W., Leon, D., and Podgurski, A. Finding failures by cluster analysis of execution profiles. 23rd Intl. Conf. on Software Engineering (Toronto, May 2001), 339-348.
7. Dickinson, W., Leon, D., and Podgurski, A. Pursuing failure: the distribution of program failures in a profile space. 10th European Software Engineering Conf. and 9th ACM SIGSOFT Symp. on the Foundations of Software Engineering (Vienna, September 2001), ACM Press, 246-255.
8. H. H. Feng, O. M. Kolesnikov, P. Fogla, W. Lee, and W. Gong. Anomaly detection using call stack information. 2003 IEEE Symposium on Security and Privacy (Berkeley, CA, May 2003).
9. Fenton, J.S. Memoryless Subsystems. The Computer Journal 17, 2 (1974), 143-147.
10. Ferrante J., Ottenstein K.J., and Warren J.D.. The Program Dependence Graph and its Use in Optimization. ACM Transactions on Programming Languages and Systems 9, 3 (October 1987), 319-349.
11. Forrest S., Hofmeyr S.S., Somayaji A., Longstaff T.A. A sense of self for UNIX processes. 1996 IEEE Symposium on Security and Privacy (Los Alamitos, CA, 1996), 120-128
12. Ghosh A. K., Schwartzbard A., and Schatz M. Learning program behavior profiles for intrusion detection. 1st USENIX Workshop on Intrusion Detection and Network Monitoring (Santa Clara, CA, April 1999).
13. JConsole, http://javaconsole.sourceforge.net. IBM 2001.
14. Jones, A. and Lipton, R. The Enforcement of Security Policies for Computation. Journal of Computer and Systems Sciences (1978).
15. Lampson, B.W. A Note on the Confinement Problem. Communication of the ACM 16, 10 (Oct. 1973), 613-615.
16. Leon, D., Masri W., Podgurski. A. An Empirical Evaluation of Test Case Filtering Techniques Based On Exercising Complex Information Flows. To appear in 2005 International Conference on Software Engineering (St. Louis, MO, May 2005).
17. Leon, D., Podgurski, A., and White, L.J. Multivariate visualization in observation-based testing. 22nd Intl. Conf. on Software Engineering (Limerick, Ireland, June 2000), ACM Press, 116-125.
18. Liepins G. and Vaccaro H. S.. Anomaly detection: purpose and framework. 12th National Computer Security Conference (Baltimore, 1989), 495-504.
19. Masri, W., Podgurski, A., and Leon, D. Detecting and Debugging Insecure Information Flows. 15th. IEEE International Symposium on Software Reliability Engineering, ISSRE 2004. St. Malo, France Nov 2-5, 2004.
20. Masri, W. Dynamic Information Flow Analysis and Dynamic Slicing, Ph.D. dissertation 2004, http://softlabnet.cwru.edu.
21. Open Source Vulnerability Database (OSVDB): www.osvdb.org.
22. The PERL Directory. www.perl.org.
23. Podgurski A. and Clarke L. A Formal Model of Program Dependencies and its Implications for Software Testing, Debugging, and Maintenance. IEEE TSE, 16(9):965-979, September 1990.
24. Podgurski A. Significance of program dependences for software testing, debugging and maintenance. Ph.D. Thesis. Computer Sc. Dept., U. of Mass., (Sept. 1989).
25. Porras P. A. and Neumann P. G.. EMERALD: event monitoring enabling responses to anomalous live disturbances. 20th NIST/NCSC National Information Systems Security Conference (Baltimore, October 1997), 353-365.
26. Sabelfeld A. and Myers A.C. Language-Based Information-Flow Security. IEEE Journal on Selected Areas in Communications, 21(1), Jan. 2003.
27. Sinha S., Harrold M. J. and Rothermel G. Interprocedural Control Dependence. ACM Transactions on Software Engineering and Methodology, (2000).
28. Tan K., Killourhy K., and Maxion R. Undermining an anomaly-based intrusion detection system using common exploits. 5th International Symposium on Recent Advances in Intrusion Detection (Zurich, October 2002).
29. The Byte Code Engineering Library (BCEL), The Apache Jakarta Project, http://jakarta.apache.org/bcel. Apache Software Foundation 2003.
30. Tomcat Java Application Server: http://jakarta.apache.org/tomcat.
31. Wagner D. and Soto P. Mimicry attacks on host-based intrusion detection systems. Proceedings of the 9th ACM conference on Computer and communications security. (Washington, D.C. November 2002), 255-264.