期刊文献+
任意字段
题名或关键词
题名
关键词
文摘
作者
第一作者
机构
刊名
分类号
参考文献
作者简介
基金资助
栏目信息

基于依赖的J2EE程序污点分析方法

J2EE Program Taint Analysis Method Based on Dependency
下载PDF
导出
摘要 污点分析通常采用近似或简化方法对大规模程序进行分析,导致分析结果不精确。为此,扩展现有变量依赖关系定义,对不同方法参数的依赖关系以及域变量和参数的依赖关系进行建模,提出一种面向J2EE程序、基于需求的数据依赖图构建方法。根据预定义的污点分析方法和扩展定义的依赖关系构建数据依赖边,采用多阶段分析方法遍历依赖图中的依赖路径,以有效分析较大规模程序。实验结果表明,与现有Java污点分析方法 TAJ相比,该方法的精确度和时间性能均有较大提高。 Taint analysis usually uses approximate or simplified method to analyze large scale program.So that the results are imprecise.In order to solve this problem,by extending current definition of dependency relation,modeling dependent relation between parameters of the method,modeling the relation between heap variable and parameters,this paper presents a new method to construct a demand-based data dependent graph orienting J2EE programs.This method uses predefined taint analysis method and extending definition for dependency relation to build data dependency edges.Multistage analysis method traverses dependency paths in dependency graph so as to analyze large scale programs efficiently.Experimental results show that the method has much improvement on analysis precision and time performance compared with Taint Analysis for Java（TAJ） method.
作者 郭帆 周轩
机构地区 江西师范大学计算机信息工程学院
出处 《计算机工程》 CAS CSCD 北大核心 2016年第6期131-138,共8页 Computer Engineering
基金 国家自然科学基金资助项目(61562040 61562041)
关键词 污点分析 依赖关系 建模方法 数据依赖图 多阶段分析 taint analysis dependency relationship modeling method data dependency graph multi-phase analysis
分类号 TP393 [自动化与计算机技术—计算机应用技术]
  • 相关文献

参考文献15

  • 1Livshits V B,Lam M S.Finding Security Vulnerabilities in Java Applications with Static Analysis[C]//Proceedings of the 14th USENIX Security Symposium.New York,USA:ACM Press,2005:18-33.
  • 2Son S,Mc Kinley K S,Shmatikov V.Diglossia:Detecting Code Injection Attacks with Precision and Efficiency[C]//Proceedings of ACM Conference on Computer and Communications Security.New York,USA:ACM Press,2013:1181-1192.
  • 3Jovanovic N,Kruegel C,Kirda E.Static Analysis for Detecting Taint-style Vulnerabilities in Web Applications[J].Journal of Computer Security,2010,18(5):861-907.
  • 4黄强,曾庆凯.基于信息流策略的污点传播分析及动态验证[J].软件学报,2011,22(9):2036-2048. 被引量：21
  • 5Wasserman G,Su Z.Static Detection of Cross-site Scripting Vulnerabilities[C]//Proceedings of the 30th ACM/IEEE International Conference on Software Engineering.New York,USA:ACM Press,2008:171-180.
  • 6Dahse J,Holz T.Simulation of Built-in PHP Features for Precise Static Code Analysis[C]//Proceedings of Network and Distributed System Security Symposium.San Diego,USA:[s.n.],2014:1-15.
  • 7Tripp O,Pistoia M,Fink S.TAJ:Effective Taint Analysis of Web Applications[C]//Proceedings of ACM SIGPLAN2009 Conference on Programming Language Design and Implementation.New York,USA:ACM Press,2009:87-97.
  • 8Martin M,Livshits B,Lam M S.Finding Application Errors and Security Flaws Using PQL:A Program Query Language[C]//Proceedings of the 20th Annual Conference of Object-oriented Programming,Systems,Languages and Applications.New York,USA:ACM Press,2005:365-383.
  • 9Horwitz S,Reps T,Binkley D.Interprocedural Slicing Using Dependence Graphs[C]//Proceedings of ACM SIGPLAN Conference on Programming Language Design and Implementation.New York,USA:ACM Press,1988:26-60.
  • 10Sridharan M,Fink S J,Bodík R.Thin Slicing[C]//Proceedings of ACM SIGPLAN 2007 Conference on Programming Language Design and Implementation.New York,USA:ACM Press,2007:112-122.

二级参考文献28

  • 1Vcnkataramani G, Doudalis I, Solihin Y, Prvulovic M. FlexiTaint: A programmable accelerator for dynamic taint propagation. In: Carter J, ed. Proc. of the 14th Int'l Syrup. on High Performance Computer Architecture (HPCA). New York: ACM Press, 2008. 173-184. Idol: 10.1109/HPCA.2008.46S8637].
  • 2Newsome J, Song D. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In: Harder E, ed. Prec. of the Network and Distributed System Security Syrup. (NDSS 2005). San Diego: National Security Agency Press, 2005. 187-204.
  • 3CVE terminology page. 2009. http://www.cve.mitre.org/about/terminology.html#vulnerability.
  • 4Sekar R. An efficient black-box technique for defeating Web application attacks. In: Vigna G, ed. Proc. of the Network and Distributed System Security Syrup. (NDSS 2009). San Diego: National Security Agency Press, 2009.23-39.
  • 5CVE and CCE statistics query page. 2009. http://web.nvd.nist.gov/view/vuln/statistics?execution=e 1 s 1.
  • 6Open Web Application Security Project (OWASP). The ten most critical Web application security vulnerabilities. 2007. http://www.owasp.org/images/e/e8/OWASP_ Top_ 10 _2007.pdf.
  • 7Lam MS, Martin MC, Livshits VB, Whaley J. Securing Web applications with static and dynamic information flow tracking. In: Hatcliff J, ed. Proc. of the 2008 ACM SIGPLAN Symp. on Partial Evaluation and Semantics-based Program Manipulation. New York: ACM Press, 2008.3-12. [doi: 10.1145/1328408.1328410].
  • 8Xie YC, Chou A, Engler D. ARCHER: Using symbolic, path-sensitive analysis to detect memory access errors. In: Paakki J, ed. Proc. of the 9th European Software Engineering Conf. Held Jointly with 1 lth ACM SIGSOFT Int'l Symp. on Foundations of Software Engineering. New York: ACM Press, 2003. 327-336. [doi: 10.1145/940071.940115].
  • 9Yin H, Song D, Egele M, Kruegel C, Kirda E. Panorama: Capturing system-wide information flow for malware detection and analysis. In: Ning P, ed. Proc. of the 14th ACM Conf. on Computer and Communications Security. New York: ACM Press, 2004. 116-127. [doi: 10.1145/1315245.1315261].
  • 10Sabelfeld A, Myers AC. Language-Based information-flow security. IEEE Journal on Selected Areas in Communications, 2003, 21(1):5-19. [doi: 10.1109/JSAC.2002.806121].

共引文献20

计算机工程
2016年 第6期

相关作者

内容加载中请稍等...

相关机构

内容加载中请稍等...

相关主题

内容加载中请稍等...

浏览历史

内容加载中请稍等...
;
使用帮助 返回顶部