Automated detection, explanation, and remediation of security inconsistencies in Web application access controls using program analysis

点击翻译按钮获取中文摘要

The proposed research aims at improving the quality and the security integrity of software, while reducing its development cost in the perspective of application security.******Today's large deployment of Web and mobile applications, cloud services, and cyber-physical systems demand frequent and short release cycles or continuous releases. This puts even more stress and time constraints on quality assurance in general and on application security.******I propose to design, implement, and evaluate automated and scalable methods for the early fault localization and automated repair of security inconsistencies and vulnerabilties in access controls in software applications.******I propose to localize faulty security code by investigating counter-examples from violated policies in security models and to synthesize human-usable explanations.******In this proposal, I want to address and investigate the automated repair of detected security inconsistencies by reasoning on the localized faults that correspond to executions that violate some role-privilege policies.******For example, missing checks could be repaired by automatically inserting proper authorization checks to restore the desired security reachability and accesses to security sensitive resources.******Two problems appear when path based security repair is sought:***(a) selection of code fragments implementing appropriate security checks to be inserted, deleted, or modified to repair the detected inconsistencies.***(b) where to insert the checks along the possibly many paths that violate the security reachability constraints.******In this proposal, I want to address first the problem of automated security repairs and second the problem of optimal placement of required new security checks.******I want to determine the categories of security problems that can be automatically repaired, thus relieving the developers from this burden.***I want to investigate their significance in large industrial or open source systems.******When automation cannot be completely achieved for some inconsistency category, I want to investigate an interactive and recommendation-based strategy to support the developers during their manual repair of inconsistencies by supplying explanations and suggestions.******The proposed research on automated repairs will prevent detected and repaired inconsistencies from being released. Software systems will be more secure and less vulnerable to attacks. The overall process from detection to repaired release will be shorter. Therefore, the window of opportunity for attacks will be dramatically reduced.******Results from this research will be methods and tools available to researchers for automatically analyzing and repairing large applications in the perspective of security. Findings about the effectiveness of automated detection and repair of inconsistencies in large and popular open source applications will also be produced.