NDLI: SENTINEL: securing database from logic flaws in web applications

Please wait, while we are loading the content...

Secure and efficient proof of storage with deduplication

Stalking online: on user privacy in social networks

On practical specification and enforcement of obligations

Relationship-based access control: its expression and enforcement through hybrid logic

Risk-based security decisions under uncertainty

Privacy streamliner: a two-stage approach to improving algorithm efficiency

Efficient run-time solving of RBAC user authorization queries: pushing the envelope

An information theoretic privacy and utility measure for data sanitization mechanisms

Practical oblivious storage

Measuring query privacy in location-based services

Deriving implementation-level policies for usage control enforcement

Bounding trust in reputation systems with incomplete information

Quantitative access control with partially-observable Markov decision processes

Privacy analysis using ontologies

A model-theoretic approach to data anonymity and inference control

SWIPE: eager erasure of sensitive data in large scale systems software

SENTINEL: securing database from logic flaws in web applications

Revisiting link privacy in social networks

Discovering access-control misconfigurations: new approaches and evaluation methodologies

The privacy in the time of the internet: secrecy vs transparency

Role engineering: from theory to practice

S2A: secure smart household appliances

Towards end-to-end secure content storage and delivery with public cloud

Leakage-free redactable signatures

Comparison-based encryption for fine-grained access control in clouds

Cookie-based privacy issues on google services

Protecting health information on mobile devices

SecDS: a secure EPC discovery service system in EPCglobal network

Detecting repackaged smartphone applications in third-party android marketplaces

Refinement-based design of a group-centric secure information sharing model

Identifying native applications with high assurance

SENTINEL: securing database from logic flaws in web applications

Content Provider	ACM Digital Library
Author	Yan, Wei Li, Xiaowei Xue, Yuan
Abstract	Logic flaws within web applications allow the attackers to disclose or tamper sensitive information stored in back-end databases, since the web application usually acts as the single trusted user that interacts with the database. In this paper, we model the web application as an extended finite state machine and present a black-box approach for deriving the application specification and detecting malicious SQL queries that violate the specification. Several challenges arise, such as how to extract persistent state information in the database and infer data constraints. We systematically extract a set of invariants from observed SQL queries and responses, as well as session variables, as the application specification. Any suspicious SQL queries that violate corresponding invariants are identified as potential attacks. We implement a prototype detection system SENTINEL (SEcuriNg daTabase from logIc flaws iN wEb appLication) and evaluate it using a set of real-world web applications. The experiment results demonstrate the effectiveness of our approach and show that acceptable performance overhead is incurred by our implementation.
Starting Page	25
Ending Page	36
Page Count	12
File Format	PDF
ISBN	9781450310918
DOI	10.1145/2133601.2133605
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2012-02-07
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Invariant Web application security Sql signature Extended finite state machine Logic flaw
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Evaluating the Security Flaws in Web Applications

LogicScope: automatic discovery of logic vulnerabilities within web applications

Securing oracle database from search engines attack.

Security Standards Perspective to Fortify Web Database Applications from Code Injection Attacks

User input, password management flaws (2014).

Lom: Discovering logic flaws within MongoDB-based web applications

Detecting sql.

SBSQLID: Securing Web Applications with Service Based SQL Injection Detection

An Automated Universal Server Level Solution for SQL Injection Security Flaw (2004)

SENTINEL: securing database from logic flaws in web applications

Similar Documents

Evaluating the Security Flaws in Web Applications

LogicScope: automatic discovery of logic vulnerabilities within web applications

Securing oracle database from search engines attack.

Security Standards Perspective to Fortify Web Database Applications from Code Injection Attacks

User input, password management flaws (2014).

Lom: Discovering logic flaws within MongoDB-based web applications

Detecting sql.

SBSQLID: Securing Web Applications with Service Based SQL Injection Detection

An Automated Universal Server Level Solution for SQL Injection Security Flaw (2004)

SENTINEL: securing database from logic flaws in web applications