TC: Small: Runtime and Static Analysis for Web Application Security

Web应用程序非常流行，使当今的许多在线业务成为可能，包括银行、购物、大学招生和各种政府活动。然而，这类应用程序的质量通常较低，而且它们越来越成为攻击的目标。该项目旨在开发实用的测试和分析机制和工具来保护Web应用程序。它特别关注于开发新的原则性技术来解决以下研究问题：(1)如何形式化Web应用程序中的安全威胁；(2)如何通过动态监控为已部署的应用程序提供运行时安全；(3)如何在应用程序开发和测试期间提供静态安全实施。该项目是跨学科的，涉及计算机安全、软件工程和编程语言等多个需求领域。它有可能通过新的安全要求、系统概念和先进的测试和分析技术来提高每一门学科的知识。该项目还可能产生重大的行业和社会影响。通过拟议的研究、教育和推广活动，该项目将赋予Web应用程序开发人员知识、方法和开发工具，以构建安全的Web应用程序。在该项目中开发的测试和分析工具还将分发给其他机构和行业，用于教学、研究和实验评估。

Web applications are prevalent and enable much of today's onlinebusiness including banking, shopping, university admissions, and variousgovernmental activities. However, the quality of such applications isusually low, and they are increasingly popular targets for attack. Thisproject aims at developing practical testing and analysis mechanisms andtools to secure web applications. In particular, it focuses ondeveloping novel, principled techniques to address the followingresearch issues: (1) how to formalize security threats in webapplications; (2) how to provide runtime security for deployedapplications via dynamic monitoring; and (3) how to provide staticsecurity enforcement during application development and testing.The project is interdisciplinary, touching upon a number of requisiteareas including computer security, software engineering, and programminglanguages. It has the potential to advance knowledge in each of thesedisciplines with novel formulations of security requirements, systemsconcepts, and advanced testing and analysis techniques. The projectalso has the potential for significant industrial and societal impact.Through the proposed research, education, and outreach activities, theproject will empower web application developers with the knowledge,methodologies, and development tools to build secure webapplications. Testing and analysis tools developed in the project willalso be distributed to other institutions and the industry for teaching,research, and experimental evaluation.