Modeling Rich Internet applications for security

网站安全是保护敏感公司、客户和员工数据、满足法规和公司合规要求以及防范数据泄露的高成本的首要任务。富互联网应用程序给安全性带来了额外的挑战，因为在客户端侧执行的网页可能包含强大的程序片段，这些程序片段可以同时、异步地执行，并且可能对用户隐藏。建议的研究旨在改进生成测试序列的方法和工具，以发现此类应用的安全漏洞。更具体地说，我们计划开发用于对给定的富互联网应用程序及其数据流进行建模的范例，提供用于自动构建此类模型的算法，并通过使用此类模型来生成测试序列以发现安全缺陷来演示我们方法的适用性。我们最初的工作重点将是检测注入故障。我们计划开发原型工具，这些工具可以为项目中开发的安全测试方法提供概念验证。

Web site security is a top priority for protecting sensitive company, customer, and employee data, for meeting regulatory and corporate compliance requirements, and for defending against the high cost of a data breach. Rich Internet Applications present additional challenges for security because of the Web pages executed at the client side may contain powerful program fragments that may execute concurrently, asynchronously and may be hidden from the view of the user. The proposed research is directed towards improving the methods and tools for generating test sequences that can uncover security vulnerabilities of such applications. More specifically, we plan to develop paradigms for modeling a given rich internet application and its data flow, to provide algorithms for automatically building such models, and to demonstrate the applicability of our methods by using such a model for generating test sequences to uncover security flaws. The initial focus of our work will be the detection of injection faults. We plan to develop prototype tools that could provide a proof of concept for the security testing methods developed within the project.