Loading...
|
Please use this identifier to cite or link to this item:
https://nccur.lib.nccu.edu.tw/handle/140.119/49474
|
| Title: | 混合式的Java網頁應用程式分析工具
A hybrid security analyzer for Java web applications |
| Authors: | 江尚倫 |
| Contributors: | 陳恭
江尚倫 |
| Keywords: | 動態分析
線上分析
資料流分析
網頁應用程式
安全性弱點
Dynamic Analysis
Online Analysis
Dataflow Analysis
Web Application
Security Vulnerabilities |
| Date: | 2009 |
| Issue Date: | 2010-12-08 12:08:54 (UTC+8) |
| Abstract: | 近年來網路應用蓬勃的發展，經由網頁應用程式提供服務或從事商業行為已經成為趨勢，因此網頁應用程式自然而然成為網路攻擊者的目標，攻擊手法也隨著時間不斷的翻新。已經有許多的方法被提出用來防範這些攻擊，增加網頁應用程式的安全性，如防火牆的機制以及加密連線，但是這些方法所帶來的效果有限，最根本的方法應為回歸原始的網頁應用程式設計，確實的找出應用程式本身的弱點，才能杜絕不斷變化的攻擊手法。以程式分析的技術來發現這些弱點是常見的方法之一，程式分析又分為靜態分析和動態分析，兩種分析技術都能有效的找出這些弱點。我們整理了近幾年的網頁應用程式分析技術，多採用靜態分析，然而比較後發現靜態分析的技術對於Java的網頁應用程式的分析，無法達到精確的分析結果，原因在於Java語言所具有的特性，如：變數的多型、反射機制的應用等。靜態分析在處理這些問題具有先天上的缺陷，由於並沒有實際的去執行程式，所以無法獲得這些執行時期才有的資訊。
本研究的重點將放在動態的程式分析技術上，也就是於程式執行期間所進行的分析，來解決分析Java網頁應用程式的上述問題。為了在程式執行期間得到可利用的分析資訊，我們運用了AspectJ的插碼技術。我們的工具會先將負責收集資訊的模組插入應用程式的源碼，並以單元測試的方式執行程式，於程式執行的過程中將分析資訊傳遞給分析模組，利用Java 語言的特性進行汙染資料的追蹤 。另外，我們考慮到以動態分析的方式偵測弱點會因為執行的路徑，導致一些潛在的弱點無法被發現，所以我們利用了線上分析的概念，設計出了線上的污染資料流分析模組，我們的工具結合了上述兩個分析模組所產生的分析結果，提供開網頁應用程式弱點資訊。
In recent years, development of web application is flourishing and the increasing population of using internet, providing customer service and making business through network has been a prevalent trend. Consequently, the web applications have become the targets of the web hackers. With the progress of information technology, the technique of web attack becomes timeless and widespread. Some approaches have been taken to prevent from web attacks, such as firewall and encrypted connection. But these approaches have a limited effect against these attack techniques. The basic method should be taken is to eliminate the vulnerabilities inside the web application. Program analysis is common technique for detecting these vulnerabilities. There are two major program analysis approaches: static analysis and dynamic analysis. Both these approaches can detect vulnerabilities effectively.
We reviewed several program analysis tools. Most of them are static analysis tool. However, we noticed that it is insufficient to analysis Java program in a static way due to the characteristic of Java language, e.g., polymorphism, reflection and more. Static has its congenital defects in examining these features, because static analysis happens when the program is not executing and lacks of runtime information.
In this thesis, we focus on dynamic analysis of programs, where the analysis occurs when the program is executing, to solve the problems mentioned above in Java web application. In order to retrieving the runtime analysis information, we utilize the instrumentation mechanism provided by AspectJ. We instrument designed module in to the program and gather the needed information and execute the program in a unit testing approach. Our dynamic analysis module retrieves the information from instrumented executing program and utilizes the characteristic of Java to perform the tainted data tracking. We considered the dynamic tracking mechanism will leave some vulnerabilities undiscovered when the program is not completely executed. Hence we adopt the online analysis concept and design an online analysis module to find out the potential vulnerabilities which cannot be detected by dynamically tracking the tainted data. Our analysis tool finally integrates these two analysis results and provides the most soundness analysis result for developers. |
| Reference: | 1. OWASP. Common types of software vulnerabilities. 2010; Available from: http://www.owasp.org/index.php/Category:Vulnerability.
2. OWASP. OWASP Top 10 for 2010. 2010; Available from: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.
3. Software., T. TIOBE Programming Community Index for April 2010. 2010; Available from: http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html.
4. Einarsson, A. and J.D. Nielsen. Soot: a Java Optimization Framework. 2010; Available from: http://www.sable.mcgill.ca/soot/#introduction.
5. Chung, C.-I., A Static Analyzer for PHP Web Applications, in Information management. 2009, National Taiwan University: Taipei. p. 1-69.
6. Hirzel, M., et al., Fast Online Pointer Analysis. ACM Transactions on Programming Languages and Systems, 2007. 29(2): p. 1-55.
7. Masuhara, H. and K. Kawauchi, Dataflow Pointcut in Aspect-Oriented Programming. LNCS, 2003. 2895: p. 105-121.
8. Halfond, W.G.J., A. Orso, and P. Manolios, WASP: Protectiong Web Applications Using Positive Tainting and Syntax - Aware Evaluation. IEEE Transactions on Software Engineering, 2008. 34(1): p. 65-81.
9. Livshits, V.B. and M.S. Lam, Finding Security Vulnerabilities in Java Applications with Static Analysis, in Computer Science 2005, Stanford University.
10. PQL. PQL: Program Query Language. 2005; Available from: http://pql.sourceforge.net/.
11. Alhadidi, D., et al. The Dataflow Pointcut - A Formal and Practical Framework. in Proceedings of the 8th ACM International Conference on Aspect-Oriented Software Development. 2009. Charlottesville, Virginia, USA.
12. Pebble. Pebble, A lightweight, open source, Java EE blogging tool. 2010; Available from: http://pebble.sourceforge.net/.
13. Scott, D. and R. Sharp., Abstracting appplication-level web security, in Proceedings of the 11th International Conference on World Wide Web. 2002. p. 396-407.
14. Scott, D. and R. sharp., Developing secure web applications. IEEE Transactions on Software Engineering, 2002. 6(6): p. 38-45.
15. Sridharan, M., S.J. Fink, and R. Bodik. Thin Slicing. in Proceedings of the 2007 ACM SIGPLAN Conference on Programming Language Design and Implementation. 2007. San Diego, California, USA.
16. Stanford, U. Stanford SecuriBench Micro. 2006; Available from: http://suif.stanford.edu/~livshits/work/securibench-micro/.
17. Tripp, O., et al. TAJ: Effective Taint Analysis of Web Applications. in Proceedings of the 2009 ACM SIGPLAN Conference on Programming Language Design and Implementation. 2009. Dublin, Ireland. |
| Description: | 碩士
國立政治大學
資訊科學學系
97753023
98 |
| Source URI: | http://thesis.lib.nccu.edu.tw/record/#G0097753023 |
| Data Type: | thesis |
| Appears in Collections: | [資訊科學系] 學位論文
|
Files in This Item:
| File |
Size | Format | |
|---|
| 302301.pdf | 735Kb | Adobe PDF2 | 1318 | View/Open |
|
All items in 政大典藏 are protected by copyright, with all rights reserved.
|
