Effective software vulnerability detection for web services

Web 服务的有效软件漏洞检测

• 批准号: LP140100437
• 负责人: Prof Harald Sondergaard
• 金额: $ 28.6万
• 依托单位: The University of Melbourne
• 依托单位国家: 澳大利亚
• 项目类别: Linkage Projects
• 财政年份: 2015
• 资助国家: 澳大利亚
• 起止时间: 2015-05-27 至 2019-12-31
• 项目状态: 已结题
• 来源: https://dataportal.arc.gov.au/RGS/Web/Grants/LP140100437
• 关键词: Effective; software; vulnerability; detection; web

This project aims to design and implement new and better methods to find vulnerabilities in software services delivered over the web or through the cloud, as well as methods for proving the absence of certain types of vulnerability. So-called injection attacks are pervasive and generally considered the most important security threat on today's Internet. The programming languages used for software services tend to use strings as a universal data structure, which unfortunately makes it hard to separate trusted code from untrusted user-provided data. This project intends to develop novel program analysis tools and string constraint solvers, and employ these tools to support sophisticated automated reasoning about string manipulating software.

该项目旨在设计和实施新的更好的方法，以发现通过网络或云提供的软件服务中的漏洞，以及证明不存在某些类型漏洞的方法。所谓的注入攻击是普遍存在的，通常被认为是当今互联网上最重要的安全威胁。用于软件服务的编程语言倾向于使用字符串作为通用数据结构，不幸的是，这使得很难将可信代码与不可信的用户提供的数据分开。本计画旨在发展新颖的程式分析工具与字串约束求解器，并利用这些工具来支援复杂的字串处理软体自动化推理。