Modeling Rich Internet applications for security

点击翻译按钮获取中文摘要

Web site security is a top priority for protecting sensitive company, customer, and employee data, for meeting regulatory and corporate compliance requirements, and for defending against the high cost of a data breach. Rich Internet Applications present additional challenges for security because of the Web pages executed at the client side may contain powerful program fragments that may execute concurrently, asynchronously and may be hidden from the view of the user. The proposed research is directed towards improving the methods and tools for generating test sequences that can uncover security vulnerabilities of such applications. More specifically, we plan to develop paradigms for modeling a given rich internet application and its data flow, to provide algorithms for automatically building such models, and to demonstrate the applicability of our methods by using such a model for generating test sequences to uncover security flaws. The initial focus of our work will be the detection of injection faults. We plan to develop prototype tools that could provide a proof of concept for the security testing methods developed within the project.