New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

王清 1; 郑庆华 1; 管晓宏 1; 2; 3; 张哲菲 1; 2

您当前的位置：

首页 >

文章列表页 >

New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree

更新时间：2025-12-08

- New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree
- Vol. 41, Issue 4, Pages: 439-443(2007)
- 作者机构：
  
  1. 西安交通大学智能网络与网络安全教育部重点实验室,西安,710049
  2. 西安交通大学机械制造系统工程国家重点实验室,西安,710049
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393
- Online First：10 April 2007，
  
  Published：2007
- 稿件说明：
移动端阅览
王清 1, 郑庆华 1, 管晓宏 1, et al. New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree[J]. 2007, 41(4): 439-443.
DOI：

王清 1, 郑庆华 1, 管晓宏 1, et al. New Method for Detecting Code Security Vulnerability Based on Reverse Deduction with Proof-Tree[J]. 2007, 41(4): 439-443. DOI：

摘要

针对Web应用中普遍存在SQL注入漏洞等问题

提出了一种基于证明树反演的漏洞定位方法.该方法可对攻击产生的根源直接进行源代码的漏洞挖掘

其核心思想是:通过在脚本中反向追踪数据库操作所涉及的变量来检验其是否受到外界的影响

从而达到控制数据库操作的安全隐患.实验结果表明

所提方法能够准确验证53.8%的数据库操作的安全性

对于不能做出自动判定的风险操作

则能给出变量的依赖关系.该方法适用于以各种脚本语言和数据库系统搭建的Web应用平台.

Abstract

Based on reverse deduction with proof-tree

a method for detecting SQL injection vulnerabilities which are ubiquitous in Web applications is presented. Differing from traditional real time security strategies such as IDS and firewall

the origin of producing attack can be found by directly mining source codes vulnerabilities. The essentials are to track reversely the variables that are related to database(DB)script operations and check whether they are influenced from outside so as to control the hidden damage existing in the DB operations. The experimental results show that the proposed method can accurately verify the security of 53.8% DB operations

and it is applicable for any type of Web application platforms configured with different script languages and database systems.

关键词

Keywords

references

Pietraszek T, Berge C V. Defending against injection attacks through context-sensitive string evaluation [C]∥8th International Symposium on Recent Advances in Intrusion Detection. Berlin: Springer-Verlag, 2006:124-145.

Buehrer G T, Bruce W. Using parse TreeValidation to prevent SQL injection attacks [C]∥Proceedings of the 5th international Workshop on Software Engineering and Middleware. New York:ACM, 2005:106-113.

Fosdick L D, Osterweil L J. Data flow analysis in software reliability [J]. Computing Surveys, 1976,8(3):305-330.

Gustafsson J, Lisper B. A tool for automatic flow analysis of C-programs for WCET calculation [C]∥8th IEEE International Workshop on Object-Oriented Real-Time Dependable Systems. Piscataway, USA: IEEE, 2003:106-112.

Walker D. A type system for expressive security policies [C]∥Proceedings of the 27th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages. New York: ACM, 2000:254-267.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Numerical Simulation of Heat-Moisture Barrier Performance of a Horizontal Air Curtain in Cold Storage

A Fast Calculation Method for Thermal Flow Fields in Transformer Windings Based on PI-DeepONet

Influence of Structural Parameters on the Summer Operational Characteristics of a Three-Tower-in-One Indirect Air-Cooling System

Integrated and Joint Design Optimization of Centrifugal Compressor Impeller and Casing Treatment at Multiple Working Points

Electrothermal Coupling Research on the Evolutionary Law of Anti-Corona Performance for High-Altitude Air-Cooled Generators

Related Author

No data

Related Institution

No data

⁰