Recovering information from RIAs users access logs

从 RIA 用户访问日志中恢复信息

• 批准号: 490512-2015
• 负责人: Jourdan, GuyVincent
• 金额: $ 4.95万
• 依托单位: University of Ottawa
• 依托单位国家: 加拿大
• 项目类别: Collaborative Research and Development Grants
• 财政年份: 2018
• 资助国家: 加拿大
• 起止时间: 2018-01-01 至 2019-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=654887
• 关键词: Recovering; information; RIAs; users; access

Web applications, and in particular "Rich Internet Applications" (RIAs), which use advanced technologies such as JavaScript, AJAX, HTML5 etc., represent an increasingly large proportion of modern systems. Nowadays, most of the interactions we have with computers involve Web and Web applications. This tendency will increase moving forward as RIAs become increasingly mobile-friendly.****For all their advantages, Web applications and RIAs are also notoriously plagued with security vulnerabilities, a problem that needs to be resolved as soon as possible. Companies such as IBM have developed a series of products and services centered on making Web applications more secure, and are now shifting their focus toward RIAs. However, these tools and services are currently limited in their ability to handle RIAs efficiently.****In this research, we aim to contribute to RIAs security in two ways: first, we will mine existing usage (HTTP) logs of the application to infer a series of technical information about the application, and then use that information to automatically configure security scanners. This will allow the automatic detection of security vulnerabilities in RIAs. Second, still using HTTP logs but from a single user, we will automatically reconstruct that user session, a reconstruction that can be used by forensics investigators after a security incident has been reported; thus dramatically improving the accuracy of the investigation while significantly cutting down the time required to perform the investigation.**

Web应用程序，特别是“富互联网应用程序”（RIA），它使用先进的技术，如JavaScript，AJAX，HTML5等，在现代系统中所占的比例越来越大。如今，我们与计算机的大多数交互都涉及Web和Web应用程序。随着RIA变得越来越移动友好，这种趋势将进一步增加。Web应用程序和RIA尽管有其所有的优点，但也因安全漏洞而臭名昭著，这是一个需要尽快解决的问题。像IBM这样的公司已经开发了一系列以使Web应用程序更加安全为中心的产品和服务，现在他们的重点正在转向RIA。然而，这些工具和服务目前在有效处理区域一体化安排方面的能力有限。在这项研究中，我们的目标是通过两种方式为RIA安全做出贡献：首先，我们将挖掘应用程序的现有使用（HTTP）日志，以推断有关应用程序的一系列技术信息，然后使用这些信息自动配置安全扫描器。这将允许自动检测RIA中的安全漏洞。第二，仍然使用HTTP日志，但来自单个用户，我们将自动重建该用户会话，在报告安全事件后，取证调查人员可以使用这种重建;从而大大提高调查的准确性，同时大大缩短执行调查所需的时间。