政大機構典藏-National Chengchi University Institutional Repository(NCCUR):Item 140.119/49474
English  |  正體中文  |  简体中文  |  Post-Print筆數 : 27 |  Items with full text/Total items : 113648/144635 (79%)
Visitors : 51610530      Online Users : 715
RC Version 6.0 © Powered By DSPACE, MIT. Enhanced by NTU Library IR team.
Scope Tips:
  • please add "double quotation mark" for query phrases to get precise results
  • please goto advance search for comprehansive author search
    •  Adv. Search
    Home ‧ Login ‧ Upload ‧ Help ‧ About ‧ Administer Goto mobile version


    Please use this identifier to cite or link to this item: https://nccur.lib.nccu.edu.tw/handle/140.119/49474


    Title: 混合式的Java網頁應用程式分析工具
    A hybrid security analyzer for Java web applications
    Authors: 江尚倫
    Contributors: 陳恭
    江尚倫
    Keywords: 動態分析
    線上分析
    資料流分析
    網頁應用程式
    安全性弱點
    Dynamic Analysis
    Online Analysis
    Dataflow Analysis
    Web Application
    Security Vulnerabilities
    Date: 2009
    Issue Date: 2010-12-08 12:08:54 (UTC+8)
    Abstract: 近年來網路應用蓬勃的發展，經由網頁應用程式提供服務或從事商業行為已經成為趨勢，因此網頁應用程式自然而然成為網路攻擊者的目標，攻擊手法也隨著時間不斷的翻新。已經有許多的方法被提出用來防範這些攻擊，增加網頁應用程式的安全性，如防火牆的機制以及加密連線，但是這些方法所帶來的效果有限，最根本的方法應為回歸原始的網頁應用程式設計，確實的找出應用程式本身的弱點，才能杜絕不斷變化的攻擊手法。以程式分析的技術來發現這些弱點是常見的方法之一，程式分析又分為靜態分析和動態分析，兩種分析技術都能有效的找出這些弱點。我們整理了近幾年的網頁應用程式分析技術，多採用靜態分析，然而比較後發現靜態分析的技術對於Java的網頁應用程式的分析，無法達到精確的分析結果，原因在於Java語言所具有的特性，如：變數的多型、反射機制的應用等。靜態分析在處理這些問題具有先天上的缺陷，由於並沒有實際的去執行程式，所以無法獲得這些執行時期才有的資訊。
    本研究的重點將放在動態的程式分析技術上，也就是於程式執行期間所進行的分析，來解決分析Java網頁應用程式的上述問題。為了在程式執行期間得到可利用的分析資訊，我們運用了AspectJ的插碼技術。我們的工具會先將負責收集資訊的模組插入應用程式的源碼，並以單元測試的方式執行程式，於程式執行的過程中將分析資訊傳遞給分析模組，利用Java 語言的特性進行汙染資料的追蹤 。另外，我們考慮到以動態分析的方式偵測弱點會因為執行的路徑，導致一些潛在的弱點無法被發現，所以我們利用了線上分析的概念，設計出了線上的污染資料流分析模組，我們的工具結合了上述兩個分析模組所產生的分析結果，提供開網頁應用程式弱點資訊。
    In recent years, development of web application is flourishing and the increasing population of using internet, providing customer service and making business through network has been a prevalent trend. Consequently, the web applications have become the targets of the web hackers. With the progress of information technology, the technique of web attack becomes timeless and widespread. Some approaches have been taken to prevent from web attacks, such as firewall and encrypted connection. But these approaches have a limited effect against these attack techniques. The basic method should be taken is to eliminate the vulnerabilities inside the web application. Program analysis is common technique for detecting these vulnerabilities. There are two major program analysis approaches: static analysis and dynamic analysis. Both these approaches can detect vulnerabilities effectively.
    We reviewed several program analysis tools. Most of them are static analysis tool. However, we noticed that it is insufficient to analysis Java program in a static way due to the characteristic of Java language, e.g., polymorphism, reflection and more. Static has its congenital defects in examining these features, because static analysis happens when the program is not executing and lacks of runtime information.
    In this thesis, we focus on dynamic analysis of programs, where the analysis occurs when the program is executing, to solve the problems mentioned above in Java web application. In order to retrieving the runtime analysis information, we utilize the instrumentation mechanism provided by AspectJ. We instrument designed module in to the program and gather the needed information and execute the program in a unit testing approach. Our dynamic analysis module retrieves the information from instrumented executing program and utilizes the characteristic of Java to perform the tainted data tracking. We considered the dynamic tracking mechanism will leave some vulnerabilities undiscovered when the program is not completely executed. Hence we adopt the online analysis concept and design an online analysis module to find out the potential vulnerabilities which cannot be detected by dynamically tracking the tainted data. Our analysis tool finally integrates these two analysis results and provides the most soundness analysis result for developers.
    Reference: 1. OWASP. Common types of software vulnerabilities. 2010; Available from: http://www.owasp.org/index.php/Category:Vulnerability.
    2. OWASP. OWASP Top 10 for 2010. 2010; Available from: http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.
    3. Software., T. TIOBE Programming Community Index for April 2010. 2010; Available from: http://www.tiobe.com/index.php/content/paperinfo/tpci/index.html.
    4. Einarsson, A. and J.D. Nielsen. Soot: a Java Optimization Framework. 2010; Available from: http://www.sable.mcgill.ca/soot/#introduction.
    5. Chung, C.-I., A Static Analyzer for PHP Web Applications, in Information management. 2009, National Taiwan University: Taipei. p. 1-69.
    6. Hirzel, M., et al., Fast Online Pointer Analysis. ACM Transactions on Programming Languages and Systems, 2007. 29(2): p. 1-55.
    7. Masuhara, H. and K. Kawauchi, Dataflow Pointcut in Aspect-Oriented Programming. LNCS, 2003. 2895: p. 105-121.
    8. Halfond, W.G.J., A. Orso, and P. Manolios, WASP: Protectiong Web Applications Using Positive Tainting and Syntax - Aware Evaluation. IEEE Transactions on Software Engineering, 2008. 34(1): p. 65-81.
    9. Livshits, V.B. and M.S. Lam, Finding Security Vulnerabilities in Java Applications with Static Analysis, in Computer Science 2005, Stanford University.
    10. PQL. PQL: Program Query Language. 2005; Available from: http://pql.sourceforge.net/.
    11. Alhadidi, D., et al. The Dataflow Pointcut - A Formal and Practical Framework. in Proceedings of the 8th ACM International Conference on Aspect-Oriented Software Development. 2009. Charlottesville, Virginia, USA.
    12. Pebble. Pebble, A lightweight, open source, Java EE blogging tool. 2010; Available from: http://pebble.sourceforge.net/.
    13. Scott, D. and R. Sharp., Abstracting appplication-level web security, in Proceedings of the 11th International Conference on World Wide Web. 2002. p. 396-407.
    14. Scott, D. and R. sharp., Developing secure web applications. IEEE Transactions on Software Engineering, 2002. 6(6): p. 38-45.
    15. Sridharan, M., S.J. Fink, and R. Bodik. Thin Slicing. in Proceedings of the 2007 ACM SIGPLAN Conference on Programming Language Design and Implementation. 2007. San Diego, California, USA.
    16. Stanford, U. Stanford SecuriBench Micro. 2006; Available from: http://suif.stanford.edu/~livshits/work/securibench-micro/.
    17. Tripp, O., et al. TAJ: Effective Taint Analysis of Web Applications. in Proceedings of the 2009 ACM SIGPLAN Conference on Programming Language Design and Implementation. 2009. Dublin, Ireland.
    Description: 碩士
    國立政治大學
    資訊科學學系
    97753023
    98
    Source URI: http://thesis.lib.nccu.edu.tw/record/#G0097753023
    Data Type: thesis
    Appears in Collections:[Department of Computer Science ] Theses

    Files in This Item:

    File SizeFormat
    302301.pdf735KbAdobe PDF21318View/Open


    All items in 政大典藏 are protected by copyright, with all rights reserved.


    社群 sharing

    著作權政策宣告 Copyright Announcement
    1.本網站之數位內容為國立政治大學所收錄之機構典藏，無償提供學術研究與公眾教育等公益性使用，惟仍請適度，合理使用本網站之內容，以尊重著作權人之權益。商業上之利用，則請先取得著作權人之授權。
    The digital content of this website is part of National Chengchi University Institutional Repository. It provides free access to academic research and public education for non-commercial use. Please utilize it in a proper and reasonable manner and respect the rights of copyright owners. For commercial use, please obtain authorization from the copyright owner in advance.

    2.本網站之製作，已盡力防止侵害著作權人之權益，如仍發現本網站之數位內容有侵害著作權人權益情事者，請權利人通知本網站維護人員(nccur@nccu.edu.tw)，維護人員將立即採取移除該數位著作等補救措施。
    NCCU Institutional Repository is made to protect the interests of copyright owners. If you believe that any material on the website infringes copyright, please contact our staff(nccur@nccu.edu.tw). We will remove the work from the repository and investigate your claim.
    DSpace Software Copyright © 2002-2004  MIT &  Hewlett-Packard  /   Enhanced by   NTU Library IR team Copyright ©   - Feedback