Java程序中数组越界和空指针错误的静态分析

介绍了静态分析的相关背景知识,对Java程序中数组越界和空指针错误的常见表现形式进行了归类,并通过实验评估了现有的Java静态分析工具功能,指出了其在跨过程分析中的不足,并对如何改进进行了讨论。     

Service vulnerability scanning based on service-oriented architecture in Web service environments

Web services are becoming the critical components of business application, but they are often invoked with critical software and application bugs that can be explored by malicious users. Because the existing centralized vulnerability scanning systems often face performance bottleneck because of huge amount of tasks, a novel service vulnerability scanning scheme is high desirable. In this paper, we propose a service vulnerability scanning scheme based on service-oriented architecture (SoA) in Web service environments. The scanning scheme contains three components, i.e., domain-oriented distributed architecture, service providing mode based on SoA and hierarchical strategy scheduling model. The hierarchical strategy scheduling model is the key of the scanning scheme, which is used to solve the problems of distributed scheduling management in vulnerability scanning process for Web service environments. We conduct a centralized scanner to compare our scheme with other schemes by the implement of prototype system. Experimental results show that our proposed scheme outperforms other schemes with respect to time cost, accuracy and load.     

Static analysis of XML transformations in Java

XML documents generated dynamically by programs are typically represented as text strings or DOM trees. This is a low-level approach for several reasons: 1) traversing and modifying such structures can be tedious and error prone, 2) although schema languages, e.g., DTD, allow classes of XML documents to be defined, there are generally no automatic mechanisms for statically checking that a program transforms from one class to another as intended. We introduce XACT, a high-level approach for Java using XML templates as a first-class data type with operations for manipulating XML values based on XPath. In addition to an efficient runtime representation, the data type permits static type checking using DTD schemas as types. By specifying schemes for the input and output of a program, our analysis algorithm will statically verify that valid input data is always transformed into valid output data and that the operations are used consistently.     

在静态编译器中实现Java异常机制的算法

将Java程序静态编译成可执行程序是使用Java虚拟机动态编译／解释执行Java程序的另一种运行Java程序的方式。针对Java异常机制的特点和静态编译的需求,在介绍Java异常处理逻辑的基础上,提出一种在静态编译器中实现Java异常机制的算法,结合Open64开源编译器,给出该算法的具体步骤以及实现方式,以SPECjvm98为测试集,验证该算法的有效性。     

Static Analysis of Object References in RMI-Based Java Software

Distributed applications provide numerous advantages related to software performance, reliability, interoperability, and extensibility. This paper focuses on distributed Java programs built with the help of the remote method invocation (RMI) mechanism. We consider points-to analysis for such applications. Points-to analysis determines the objects pointed to by a reference variable or a reference object field. Such information plays a fundamental role as a prerequisite for many other static analyses. We present the first theoretical definition of points-to analysis for RMI-based Java applications, and we present an algorithm for implementing a flow- and context-insensitive points-to analysis for such applications. We also discuss the use of points-to information for corrupting call graph information, for understanding data dependencies due to remote memory locations, and for identifying opportunities for improving the performance of object serialization at remote calls. The work described in this paper solves one key problem for static analysis of RMI programs and provides a starting point for future work on improving the understanding, testing, verification, and performance of RMI-based software     

一种JAVA程序静态切片的方法

JAVA语言是目前一种主要的面向对象编程语言,由于JAVA语言复杂的结构,使得对JAVA程序进行程序切片非常困难.本文提出一种层次的构造JAVA系统依赖图的算法,基于JAVA程序本身的层次结构,自顶向下构造系统依赖图,然后基于构造的系统依赖图,用一种改进的两阶段算法得到JAVA程序切片.     

Java资源泄露静态分析

编程中的资源泄露是关系到软件性能的关键问题,如果处理不当,会大大降低软件的性能。文章阐述了Java语言编程中常见的资源泄露原因,并详细分析了容易产生资源泄露的几种情况。     

基于演化的漏洞检测框架*

为了解决目前主流的漏洞检测工具计算成本高、网络负载高、影响应用系统运行的问题,提出了基于演化的漏洞判定算法,基于演化的漏洞检测框架及其原型系统。该系统在传统的漏洞检测中引入计算机免疫理论,通过对计算机演化的监控来实现漏洞检测。该系统以订阅者/发布者分布式结构组织,订阅者负责收集其系统特征,发布者负责检测漏洞。实验测试结果表明,与其他的漏洞检测工具相比,其具备检测速度快,对网络运行影响小,对应用系统影响小的特点,适用于大规模计算网络。     

Tool support for testing concurrent Java components

Concurrent programs are hard to test due to the inherent nondeterminism. This paper presents a method and tool support for testing concurrent Java components. Tool support is offered through ConAn (Concurrency Analyser), a tool for generating drivers for unit testing Java classes that are used in a multithreaded context. To obtain adequate controllability over the interactions between Java threads, the generated driver contains threads that are synchronized by a clock. The driver automatically executes the calls in the test sequence in the prescribed order and compares the outputs against the expected outputs specified in the test sequence. The method and tool are illustrated in detail on an asymmetric producer-consumer monitor. Their application to testing over 20 concurrent components, a number of which are sourced from industry and were found to contain faults, is presented and discussed.     

基于静态分析的Java源代码后门检测技术研究

Web工程中存在的后门给网站安全带来极大风险,针对日益猖獗的后门攻击,文章提出了一种基于静态分析的后门检测技术,该技术通过分析源代码,可以检测出Java语言Web工程中存在的主要后门漏洞,并结合流分析及关键数据传播分析,给出漏洞的完整攻击路径。     

ActiveX控件中不安全方法漏洞的检测技术

针对AetiveX漏洞被攻击者频繁地使用来攻击系统和由不安全方法引起的漏洞可能会允许远程攻击者任意地访问本地资源的问题,介绍了检查ActiveX控件中不安全漏洞的一般方法,并且使用该方法对几款国内软件进行测试,实验表明该方法能有效挖掘到不安全方法漏洞.     

Improving the Security of Downloadable Java Applications With Static Analysis

Today, most middle-end mobile phones embed a Java runtime environment that can execute programs downloaded on the network by the user. This new functionality creates great opportunities for new services but also brings the full range of risks that existed on the personal computer to the phone.Telecommunication operators are the last warrant of the quality of the software downloaded by their customers and might sign the applications they trust. Unfortunately they have little evidence to check the quality of the contents of the jammed bytecode they receive from developers. The traditional evaluation process relies mostly on the manual testing of the software on actual terminals. But this is not adapted for security properties.MATOS (Midlet Analysis TOol Suite) is a static analysis tool that checks the possible values passed to some identified methods directly on the compiled application. It is used by the test teams of the mobile operator Orange to check what kind of connections are opened by MIDP applications. We will present the security requirements we want to check, how MATOS helps to ensure them and how the necessary analysis are performed using a combination of (rather) well-known analysis techniques.     

基于反编译的循环脆弱点检测

循环拷贝出错是缓冲区溢出漏洞产生的主要原因之一。为了提高此类漏洞的检测效率, 提出一种基于反编译的循环脆弱点检测方法。该方法首先对目标文件进行反编译, 在反编译的基础上构建函数的AST(抽象语法树), 设计算法提取函数内部的循环信息; 然后根据循环脆弱点存在的特性, 构建有限状态自动机, 对循环脆弱点进行检测。该方法在无源码漏洞检测方面有明显优势, 能有效发掘软件中存在的循环脆弱点, 提高漏洞挖掘的效率和自动化程度。     

数据关联性分析辅助漏洞挖掘

为了提高对缓冲区溢出漏洞的挖掘效率, 提出了使用数据关联性分析辅助漏洞挖掘的方法。该方法首先对目标文件进行反编译, 在反编译的基础上构建函数的抽象语法树 (AST), 设计算法提取关键变量的反向关联信息, 之后将提取的信息应用到漏洞挖掘中。该方法在无源码漏洞挖掘方面有明显优势, 能有效发掘软件中存在的缓冲区溢出漏洞可疑点, 提高漏洞挖掘的效率和自动化程度。     

基于Java Web组件技术的毕业设计管理系统

针对上海理工大学校园数字化管理现状及毕业管理工作的实际需求,设计了基于Java Web组件技术的毕业设计管理系统的基本模块,阐述了毕业设计管理系统的基本流程,设计了用于数据处理、文件管理及生成用户身份校验码的JavaBeans,提出了学生选题的随机方法.     

多线程Java程序安全行为模型的静态检查方法

多线程作为支持程序结构化和并行化的重要机制,其应用越来越广泛,多线程应用程序的安全性也成为新的研究热点之一.针对Java多线程程序,文中采用参数化扩展上下文无关文法作为其安全相关行为模型的抽象表示,给出了从多线程Java程序自动生成安全相关行为模型的方法,形式地描述了静态检查该模型是否满足安全策略的实现,并应用到携带模型代码方法的实现框架中.该方法为安全执行非信任多线程Java移动代码提供了有效支持.     

Static detection of application backdoors

Backdoors in legitimate software, whether maliciously inserted or carelessly introduced, are a risk that should be detected prior to the affected software or system being deployed. Automated static analysis of executable code can detect many classes of malicious behavior. This paper will cover the techniques that can be employed to detect special credentials, hidden commands, information leakage, rootkit behavior, anti-debugging, and time bombs.     

Static program analysis assisted dynamic taint tracking for software vulnerability discovery

The evolution of computer science has exposed us to the growing gravity of security problems and threats. Dynamic taint analysis is a prevalent approach to protect a program from malicious behaviors, but fails to provide any information about the code which is not executed. This paper describes a novel approach to overcome the limitation of traditional dynamic taint analysis by integrating static analysis into the system and presents framework SDCF to detect software vulnerabilities with high code coverage. Our experiments show that SDCF is not only able to provide efficient runtime protection by introducing an overhead of 4.16× based on the taint tracing technique, but is also capable of discovering latent software vulnerabilities which have not been exploited, and achieve code coverage of more than 90%.     

Automata-based symbolic string analysis for vulnerability detection

Verifying string manipulating programs is a crucial problem in computer security. String operations are used extensively within web applications to manipulate user input, and their erroneous use is the most common cause of security vulnerabilities in web applications. We present an automata-based approach for symbolic analysis of string manipulating programs. We use deterministic finite automata (DFAs) to represent possible values of string variables. Using forward reachability analysis we compute an over-approximation of all possible values that string variables can take at each program point. Intersecting these with a given attack pattern yields the potential attack strings if the program is vulnerable. Based on the presented techniques, we have implemented Stranger, an automata-based string analysis tool for detecting string-related security vulnerabilities in PHP applications. We evaluated Stranger on several open-source Web applications including one with 350,000+ lines of code. Stranger is able to detect known/unknown vulnerabilities, and, after inserting proper sanitization routines, prove the absence of vulnerabilities with respect to given attack patterns.