TC: Small: Keeping Jack in the Box: Confining the Role of Untrusted Inputs in Web Scenarios

大量针对Web浏览器和Web应用程序的攻击都是通过使用恶意输入而成功的。例如，对web浏览器扩展的攻击通过提供恶意输入来利用易受攻击的扩展（附加组件）来攻击浏览器。恶意输入会导致意想不到的行为，从而破坏基于web的系统的机密性、完整性和可用性。该项目系统地研究了用户输入在web浏览器和应用程序中所起的作用，并开发了通过限制其影响来防止这些攻击的技术。挑战在于为基于web的平台（如JavaScript）开发可靠且精确的自动化分析机制。来自静态和动态分析，信息流跟踪和学习程序行为领域的研究将用于开发健壮，高效和高精度的技术。该项目的论文将会在网络安全的热门网上资源中发布，以尽可能广泛地传播和进一步加强。此外，pi将把这项研究的结果传递给Web开发和标准社区。该项目的成果将被整合到伊利诺伊大学芝加哥分校和厄巴纳香槟分校的本科和研究生课程中。这些课程将培养越来越多的软件工程师，他们将更有安全意识，并将这些原则应用于为更安全的网络搭建平台。该项目还将直接为三名博士生的研究培训提供指导。该项目还将支持pi参与针对K-12教师培训和少数民族群体的外展活动，并通过设计项目来提高人们对计算机科学的认识和兴趣。

A significant number of attacks on Web browsers and Web applicationsare successful through the use of malicious inputs.For instance, attacks on web browser extensions target browsers byexploiting vulnerable extensions (add-ons) by supplying malicious input. Malicious inputs exercise unintended behaviors leading to attacks thatcompromise confidentiality, integrity andavailability of web-based systems. This project systematicallyexamines the role that user inputs play in web browsers and applications, and develops techniques to prevent these attacks by confining their influence. The challenge is to develop sound and precise automated analysis mechanisms for web based platforms such as JavaScript. Research from the areas of static and dynamic analysis, information flow tracking and learning program behaviorswill be used to develop robust, efficient and highly precise techniques.Papers from the project will be distributed in popular onlineresources for Web security for the widest possible dissemination andfurther enhancement. Furthermore, the PIs will transition results fromthis research to Web development and standards communities. The results of this project will be integrated into the new andexisting courses in the undergraduate and graduate curricula at theUniversity of Illinois campuses at Chicago and Urbana Champaign. These courses will train a growing workforce of software engineerswho will be more security-aware and apply these principles forlaying a platform for a more secure Web. This project will also directlycontribute to the research training of three Ph.D. studentssupervised by the PIs. This project will also support the involvementof the PIs in outreach activities aimed at K-12 teacher training andminority groups, and contributions by designing programs that createawareness and interest in computer science.