基于状态偏离分析的Web访问控制漏洞检测方法  

Approach of Web Application Access Control Vulnerability Detection Based on State Deviation Analysis

作　　者：马琪灿 武泽慧 王允超[1] 王新蕾 MA Qican;WU Zehui;WANG Yunchao;WANG Xinlei(State Key Laboratory of Mathematical Engineering and Advanced Computing,Information Engineering University,Zhengzhou 450001,China)

机构地区：[1]信息工程大学数学工程与先进计算国家重点实验室,郑州450001

出　　处：《计算机科学》2023年第2期346-352,共7页Computer Science

基　　金：国家重点研发计划(2019QY0501)。

摘　　要：攻击者可利用Web应用程序中存在的漏洞实施破坏应用功能、木马植入等恶意行为。针对Web应用程序的访问控制漏洞的检测问题,现有方法由于代码特征难提取、行为刻画不准确等问题导致误报率和漏报率过高,且效率低下。文中提出了一种基于状态偏离分析的Web访问控制漏洞检测方法,结合白盒测试技术,提取代码中与访问控制有关的约束,以此生成Web应用程序预期访问策略,再通过动态分析生成Web应用程序实际访问策略,将对访问控制漏洞的检测转换为对状态偏离的检测。使用提出的方法开发原型工具ACVD,可对访问控制漏洞中未授权访问、越权访问等类型的漏洞进行准确检测。在5个真实Web应用程序中进行测试,发现16个真实漏洞,查全率达到了98%,检测效率较传统黑盒工具提升了约300%。Attackers can exploit vulnerabilities in Web applications to implement malicious behaviors such as disrupting application functionality and Trojan implantation.For the detection of access control vulnerabilities in Web applications,existing me-thods have high false alarm,leakage rates and low efficiency due to the difficulty of extracting code features and inaccurate beha-vior portrayal.This paper proposes a method for detecting Web access control vulnerabilities based on state deviation analysis,which combines white-box testing techniques to extract access control-related constraints in code to generate Web application expected access policies,and then generates Web application actual access policies through dynamic analysis,converting the detection of access control vulnerabilities into the detection of state deviation.Using this technology to develop the prototype tool ACVD,it is possible to accurately detect the types of access control vulnerabilities such as unauthorized access and ultra vires access.Tested in 5 real Web applications,16 real vulnerabilities are found,and the recall rate reaches 98%,which is about 300%higher than traditional black box tools.

关 键 词：WEB应用程序 访问控制漏洞 逻辑漏洞 有限状态机 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]