TC: Small: Runtime and Static Analysis for Web Application Security

点击翻译按钮获取中文摘要

Web applications are prevalent and enable much of today's onlinebusiness including banking, shopping, university admissions, and variousgovernmental activities. However, the quality of such applications isusually low, and they are increasingly popular targets for attack. Thisproject aims at developing practical testing and analysis mechanisms andtools to secure web applications. In particular, it focuses ondeveloping novel, principled techniques to address the followingresearch issues: (1) how to formalize security threats in webapplications; (2) how to provide runtime security for deployedapplications via dynamic monitoring; and (3) how to provide staticsecurity enforcement during application development and testing.The project is interdisciplinary, touching upon a number of requisiteareas including computer security, software engineering, and programminglanguages. It has the potential to advance knowledge in each of thesedisciplines with novel formulations of security requirements, systemsconcepts, and advanced testing and analysis techniques. The projectalso has the potential for significant industrial and societal impact.Through the proposed research, education, and outreach activities, theproject will empower web application developers with the knowledge,methodologies, and development tools to build secure webapplications. Testing and analysis tools developed in the project willalso be distributed to other institutions and the industry for teaching,research, and experimental evaluation.