DMCA
Type-based Taint Analysis of Java Web Applications
Cached
Download Links
| Citations: | 2 - 2 self |
BibTeX
@MISC{Huang_type-basedtaint,
author = {Wei Huang and Ana Milanova},
title = {Type-based Taint Analysis of Java Web Applications},
year = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Abstract—Static taint analysis detects information flow vulnerabilities in Java web applications. It has gained considerable importance in the last decade, with the majority of work focusing on dataflow and points-to based approaches. In this paper, we advocate type-based taint analysis. Specifically, we present SFlow, a context-sensitive type system for secure information flow, and a corresponding inference analysis SFlowInfer. Our approach is effective for handling of libraries, frameworks and reflection, features notoriously difficult for dataflow and points-to-based taint analysis of web applications. We implemented SFlow and SFlowInfer. Empirical results on 13 real-world Java web applications show that our approach is precise and scalable. It achieves false positive rate of 15 % while scaling linearly in practice. I.
Keyphrases
type-based taint analysis java web application abstract static taint analysis considerable importance context-sensitive type system secure information flow real-world java web application false positive rate corresponding inference analysis sflowinfer empirical result last decade points-to-based taint analysis web application information flow vulnerability
