期刊
COMPUTERS & SECURITY
卷 44, 期 -, 页码 104-118出版社
ELSEVIER ADVANCED TECHNOLOGY
DOI: 10.1016/j.cose.2014.04.007
关键词
Web applications; Sensitive operation; Input validation; Sanitization; SQL injection; Query result size
资金
- MSIP (Ministry of Science, ICT and Future Planning), Korea, under the ITRC (Information Technology Research Center) [NIPA-2014-H0301-14-1023]
Web applications are becoming an essential part of our everyday lives, with many of our activities dependent on the functionality and security of these applications. Web applications are ubiquitous, perform mission critical tasks, and handle sensitive user data. As the scale of these applications grows, injection vulnerabilities, such as SQL injections, become major security challenges. Most of these vulnerabilities stem from a lack of input validation; that is, web applications use malicious input as part of a sensitive operation without properly checking or sanitizing the input values. SQL injection attacks target databases that are accessible through a web front-end; moreover, they take advantage of flaws in the input validation logic of web components. In this paper, we exhibit a novel scheme that automatically transforms web applications, rendering them safe against SQL injection attacks. Our technique dynamically analyzes the developer-intended query result size for any input, and detects attacks by comparing this against the result of the actual query. We implement this technique in a tool for protecting Java-based web applications. An experimental evaluation demonstrates that our technique is effective against SQL injection vulnerabilities. (C) 2014 Published by Elsevier Ltd.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据