Novel advancements in static analysis of serverless applications

近年来，无服务器计算范式（允许通过使用由提供商管理的云服务来开发应用程序）已经变得非常流行。采用这种方法的公司可以专注于其软件产品的业务逻辑，从而降低成本。尽管如此，保护这些应用程序的工具仍在不断发展。特别是静态分析，仍然非常具有挑战性，因为实现所使用的服务的代码对开发人员不可用。因此，这个博士项目的主要目标是开发一种新的方法，允许静态分析无服务器应用程序，即，在部署之前，为了检测安全漏洞。鉴于其重要性，应优先确定导致代码注入漏洞和未经授权披露信息的安全敏感数据流。必须实施该方法，然后使用一套基准进行验证，该基准是通过考虑以前的研究以及实际应用程序的示例而开发的。最后，原型静态分析工具将被用来分析一个大型数据集，以测试所提出的方法的有效性，并确定其局限性。

In recent years, the serverless computing paradigm, which allows developing applications by using cloud services managed by a provider, has become very popular. Companies adopting this approach can focus on the business logic of their software products, thus reducing their costs. Despite this, the tools to secure these applications are still evolving. Static analysis, in particular, remains very challenging because the code that implements the used services is not available to the developer.The chief objective of this PhD project is therefore the development of a novel methodology that allows analysing serverless applications statically, i.e., before their deployment, in order to detect security vulnerabilities. Given their importance, the identification of security-sensitive data flows leading to code injection vulnerabilities and unauthorized disclosure of information should be prioritized.The methodology will have to be implemented and then validated with a set of benchmarks, developed by considering previous research as well as examples of real-world applications. Finally, the prototyped static analysis tool will be used to analyse a large dataset in order to test the effectiveness of the proposed approach and identify its limitations.