CAREER: A Framework for Preventing Web-based Attacks

点击翻译按钮获取中文摘要

This award is funded under the American Recovery and Reinvestment Act of 2009 (Public Law 111-5).The World Wide Web is a critical infrastructure that serves our societyby facilitating information exchange, business andeducation. As it continues to evolve, the number of web-basedattacks that target innocent web users keeps increasing. Examples of such attacks include Cross-site Scripting, SQL Injectionand Cross-site Request Forgery. Recent attacks on end-users andonline enterprises through these virulent attacks have resulted inwidespread damage. Defending these attacks is therefore of very important concern to Internet economy and to society-at-large. This project develops a comprehensive plan for defending web applications from these attacks. The technical contributions of this project are in the development of thetechnologies that elicit the intended behavior of a web applicationand prevent attacks by enforcing these intended behaviors. We builda framework in which the intentions of a web application are represented using models, which are then enforced to ensure robust prevention of attacks. This framework uses novel techniques based on static and dynamicanalysis, symbolic evaluation, runtime checking and isolated execution as foundations. This project also developstechniques that enable a web application and a browser tocollaborate in order to prevent attacks, and apply fine-grainedrestrictions on Web content. The tools being developed in this project will have immediate impact on defending legacy web applications that are vulnerable to these attacks. The CAREER research project is closely tied with educationalefforts by integrating topics on web security in the undergraduate and graduate computer security classrooms. Finally, a collaborative effort with a Chicago inner-city elementary school is also part of this project's educational mission.