DMCA
Securing Web Application Code by Static Analysis and Runtime Protection (2004)
Cached
Download Links
| Citations: | 234 - 2 self |
BibTeX
@MISC{Huang04securingweb,
author = {Yao-Wen Huang and Fang Yu and Christian Hang and Chung-hung Tsai and D. T. Lee and Sy-yen Kuo},
title = {Securing Web Application Code by Static Analysis and Runtime Protection},
year = {2004}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Security remains a major roadblock to universal acceptance of the Web for many kinds of transactions, especially since the recent sharp increase in remotely exploitable vulnerabilities has been attributed to Web application bugs. Many verification tools are discovering previously unknown vulnerabilities in legacy C programs, raising hopes that the same success can be achieved with Web applications. In this paper, we describe a sound and holistic approach to ensuring Web application security. Viewing Web application vulnerabilities as a secure information flow problem, we created a lattice-based static analysis algorithm derived from type systems and typestate, and addressed its soundness. During the analysis, sections of code considered vulnerable are instrumented with runtime guards, thus securing Web applications in the absence of user intervention. With sufficient annotations, runtime overhead can be reduced to zero. We also created a tool named WebSSARI (Web application Security by Static Analysis and Runtime Inspection) to test our algorithm, and used it to verify 230 open-source Web application projects on SourceForge.net, which were selected to represent projects of different maturity, popularity, and scale. 69 contained vulnerabilities and their developers were notified. 38 projects acknowledged our findings and stated their plans to provide patches. Our statistics also show that static analysis reduced potential runtime overhead by 98.4%.
Keyphrases
static analysis runtime protection web application code web application security web application runtime inspection secure information flow problem holistic approach web application bug legacy program runtime overhead sufficient annotation major roadblock user intervention unknown vulnerability exploitable vulnerability web application vulnerability potential runtime many kind open-source web application project runtime guard many verification tool universal acceptance different maturity contained vulnerability type system lattice-based static analysis algorithm recent sharp increase
