TC: Small:Automata Based String Analysis for Detecting Vulnerabilities in Web Applications

TC：Small：基于自动机的字符串分析，用于检测 Web 应用程序中的漏洞

• 批准号: 0916112
• 负责人: Tevfik Bultan
• 金额: $ 35万
• 依托单位: University of California-Santa Barbara
• 依托单位国家: 美国
• 项目类别: Standard Grant
• 财政年份: 2009
• 资助国家: 美国
• 起止时间: 2009-09-01 至 2013-08-31
• 项目状态: 已结题
• 来源: https://www.nsf.gov/awardsearch/showAward?AWD_ID=0916112&HistoricalAwards=false
• 关键词: TC; Small; Automata; Based; String

Web applications contain numerous vulnerabilities that can be exploitedby attackers to gain unauthorized access to confidential information andto manipulate sensitive data. Many of these vulnerabilities are due toinadequate manipulation of string variables. String analysis, a techniquethat captures the string values that a certain variable might hold at aparticular program point, can be used to identify such flaws. In thisproject, novel and precise string analysis techniques will be developedusing an automata-based approach that represents possible values of astring variable at a program point as an automaton. Techniques thatsupport path-sensitivity and that enable precise analysis of loops usingautomata-based widening operations will be developed. Basic string analysistechniques will be extended to a composite analysis where relationships amongstring variables and other types of variables can be automatically discoveredand analyzed. The precision of string analysis plays a central role forobtaining good results with static vulnerability detection tools. Theprecise string analysis techniques developed in this project will enableanalysis of programs that cannot be analyzed with existing techniques. Theresults of these improved string analysis techniques will lead to novelsoftware security solutions and detection of novel types of vulnerabilities.

Web应用程序包含许多漏洞，攻击者可以利用这些漏洞未经授权访问机密信息并操纵敏感数据。这些漏洞中有许多是由于对字符串变量的操作不当造成的。字符串分析是一种捕获特定程序点上某个变量可能包含的字符串值的技术，可以用来识别此类缺陷。 在这个项目中，新颖而精确的字符串分析技术将使用基于自动机的方法来开发，该方法将程序点处字符串变量的可能值表示为自动机。 将开发支持路径敏感性和使用基于自动机的加宽操作对环路进行精确分析的技术。基本的字符串分析技术将被扩展到一个复合分析，其中关系字符串变量和其他类型的变量可以被自动发现和分析。 字符串分析的精度对于静态漏洞检测工具获得良好的结果起着核心作用。在这个项目中开发的精确的字符串分析技术将能够分析现有技术无法分析的程序。这些改进的字符串分析技术的结果将导致新的软件安全解决方案和检测新类型的漏洞。