NDLI: Security slicing for auditing XML, XPath, and SQL injection vulnerabilities

Content Provider	IEEE Xplore Digital Library
Author	Thome, J. Shar, L.K. Briand, L.
Copyright Year	2015
Description	Author affiliation: SnT Centre for Security, Univ. of Luxembourg, Luxembourg City, Luxembourg (Thome, J.; Shar, L.K.; Briand, L.)
Abstract	XML, XPath, and SQL injection vulnerabilities are among the most common and serious security issues for Web applications and Web services. Thus, it is important for security auditors to ensure that the implemented code is, to the extent possible, free from these vulnerabilities before deployment. Although existing taint analysis approaches could automatically detect potential vulnerabilities in source code, they tend to generate many false warnings. Furthermore, the produced traces, i.e. dataflow paths from input sources to security-sensitive operations, tend to be incomplete or to contain a great deal of irrelevant information. Therefore, it is difficult to identify real vulnerabilities and determine their causes. One suitable approach to support security auditing is to compute a program slice for each security-sensitive operation, since it would contain all the information required for performing security audits (Soundness). A limitation, however, is that such slices may also contain information that is irrelevant to security (Precision), thus raising scalability issues for security audits. In this paper, we propose an approach to assist security auditors by defining and experimenting with pruning techniques to reduce original program slices to what we refer to as security slices, which contain sound and precise information. To evaluate the proposed pruning mechanism by using a number of open source benchmarks, we compared our security slices with the slices generated by a state-of-the-art program slicing tool. On average, our security slices are 80% smaller than the original slices, thus suggesting significant reduction in auditing costs.
Starting Page	553
Ending Page	564
File Size	232098
Page Count	12
File Format	PDF
e-ISBN	9781509004065
DOI	10.1109/ISSRE.2015.7381847
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-11-02
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Security XML Java Scalability Data mining Feature extraction Web services vulnerability Security auditing static analysis
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

A Learning-Based Approach to Secure Web Services from SQL/XPath Injection Attacks

PXpathV: Preventing XPath Injection Vulnerabilities in Web Applications

Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services

Web Service Security Analysis Model Based on Program Slicing

Finding security vulnerabilities in java applications with static analysis (2005).

JoanAudit: a tool for auditing common injection vulnerabilities

Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services

A Static Analysis Framework for Detecting SQL Injection Vulnerabilities (2007)

Mining input sanitization patterns for predicting SQL injection and cross site scripting vulnerabilities

Security slicing for auditing XML, XPath, and SQL injection vulnerabilities

Similar Documents

A Learning-Based Approach to Secure Web Services from SQL/XPath Injection Attacks

PXpathV: Preventing XPath Injection Vulnerabilities in Web Applications

Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services

Web Service Security Analysis Model Based on Program Slicing

Finding security vulnerabilities in java applications with static analysis (2005).

JoanAudit: a tool for auditing common injection vulnerabilities

Comparing the Effectiveness of Penetration Testing and Static Code Analysis on the Detection of SQL Injection Vulnerabilities in Web Services

A Static Analysis Framework for Detecting SQL Injection Vulnerabilities (2007)

Mining input sanitization patterns for predicting SQL injection and cross site scripting vulnerabilities

Security slicing for auditing XML, XPath, and SQL injection vulnerabilities