改进的Web注入型脆弱性检测方法  

Improved approach to detecting Web injection vulnerabilities

作　　者：吕庆伟[1,2] 曾庆凯[1,2] 

机构地区：[1]南京大学计算机软件新技术国家重点实验室,江苏南京210093 [2]南京大学计算机科学与技术系,江苏南京210093

出　　处：《计算机工程与设计》2013年第12期4137-4141,共5页Computer Engineering and Design

基　　金：国家自然科学基金项目(61170070);国家科技支撑计划基金项目(2012BAK26B01);国家863高技术研究发展计划基金项目(2011AA1A202)

摘　　要：针对现有Web注入型脆弱性检测方案大多只关注过滤型验证而忽略检查型验证这一不足,提出污染驱动的切片方法。以污点分析指导具体的程序切片过程,能够完整地提取程序中的两种验证操作;借助分步的、攻击者视角的字符串分析对验证操作的验证能力进行评价分析,以更准确的检测web注入型脆弱性。实现了一个原型系统Valer,实验结果表明该方法有效降低了分析中的误报率,具有实用价值。To solve the problem that most existing approaches find Web injection vulnerabilities only focusing on filter-based validations while ignoring check-based validations, a taint-driven slicing approach is proposed. This approach, specifying program slicing process by taint analysis, extracts both filter-based validations and check-based validations in programs. And by evaluating the ability of these validations on hierarchical string analysis in attacker＇s view, Web injection vulnerabilities are detected more precisely. A prototype tool called Valer is implemented and experimental result shows that this approach can reduce false positives effectively.

关 键 词：web注入型脆弱性 输入验证 污染驱动的切片 攻击者视角 字符串分析 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]