面向软件攻击面的Web应用安全评估模型研究  

Security assessment of web applications based on software attack surface

作　　者：张玉凤[1] 楼芳[1] 张历[1] 

机构地区：[1]中国工程物理研究院计算机应用研究所,四川绵阳621900

出　　处：《计算机工程与科学》2016年第1期73-77,共5页Computer Engineering & Science

摘　　要：Web应用已成为互联网和企事业单位信息管理的主要模式。随着Web应用的普及,攻击者越来越多地利用它的漏洞实现恶意攻击,Web应用的安全评估已成为信息安全研究的热点。结合Web应用的业务逻辑,提出了其相关资源软件攻击面的形式化描述方法,构造了基于软件攻击面的攻击图模型,在此基础上,实现对Web应用的安全评估。本文构造的安全评估模型,在现有的通用漏洞检测模型基础上,引入业务逻辑安全性关联分析,解决了现有检测模型业务逻辑安全检测不足的缺陷,实现了Web应用快速、全面的安全评估。Web applications have become the principal model of the internet and enterprise information management. With their popularity, attackers launch malicious attacks via their vulnerability. Security assessment of web applications is a major information security concern. In this paper, we first discuss the formal description of software attack surface via business logic of web applications, and then construct an attack graph model. On such basis, we realize the security assessment in web applications. Based on current general vulnerability detection model, the proposed security assessment model introduces correlation analysis of business logic security. Our proposal overcomes the defects of current testing models of business logic assessment, and achieves fast and comprehensive security assessment of web applications.

关 键 词：WEB应用 软件攻击面 攻击图 安全评估 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]