Reference : Security Slicing for Auditing Common Injection Vulnerabilities
Scientific journals : Article
Engineering, computing & technology : Computer science
Security, Reliability and Trust
http://hdl.handle.net/10993/29924
Security Slicing for Auditing Common Injection Vulnerabilities
English
Thome, Julian mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Shar, Lwin Khin mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Bianculli, Domenico mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
Briand, Lionel mailto [University of Luxembourg > Interdisciplinary Centre for Security, Reliability and Trust (SNT) > >]
In press
The Journal of Systems & Software
Elsevier
Yes (verified by ORBilu)
International
0164-1212
[en] Security auditing ; static analysis ; vulnerability ; automated code fixing
[en] Cross-site scripting and injection vulnerabilities are among the most common and serious security issues for Web applications. Although existing static analysis approaches can detect potential vulnerabilities in source code, they generate many false warnings and source-sink traces with irrelevant information, making their adoption impractical for security auditing.
One suitable approach to support security auditing is to compute a program slice for each sink, which contains all the information required for security auditing. However, such slices are likely to contain a large amount of information that is irrelevant to security, thus raising scalability issues for security audits.
In this paper, we propose an approach to assist security auditors by defining and experimenting with pruning techniques to reduce original program slices to what we refer to as security slices, which contain sound and precise information.
To evaluate the proposed approach, we compared our security slices to the slices generated by a state-of-the-art program slicing tool, based on a number of open-source benchmarks. On average, our security slices are 76% smaller than the original slices. More importantly, with security slicing, one needs to audit approximately 1% of the total code to fix all the vulnerabilities, thus suggesting significant reduction in auditing costs.
SnT - Interdisciplinary Centre for Security, Reliability and Trust
Fonds National de la Recherche - FnR
Researchers ; Professionals
http://hdl.handle.net/10993/29924
10.1016/j.jss.2017.02.040
FnR ; FNR9132112 > Julian Thome > HyVAn > A Scalable and Accurate Hybrid Vulnerability Analysis Framework > 01/09/2014 > 14/04/2017 > 2014

File(s) associated to this reference

Fulltext file(s):

FileCommentaryVersionSizeAccess
Limited access
jss2016.pdfAuthor postprint720.17 kBRequest a copy

Bookmark and Share SFX Query

All documents in ORBilu are protected by a user license.