An Integrated Approach for Effective Injection Vulnerability Analysis of Web Applications through Security Slicing and Hybrid Constraint Solving

摘要

Malicious users can attack Web applications by exploiting injectionvulnerabilities in the source code. This work addresses the challengeof detecting injection vulnerabilities in a scalable and effectiveway. We propose an integrated approach that seamlessly combinessecurity slicing with hybrid constraint solving, i.e., constraintsolving based on a combination of automata-based solving andmeta-heuristic search. We use static analysis to extract minimalprogram slices relevant to security from Web programs and to generateattack conditions. We then apply hybrid constraint solving todetermine the satisfiability of attack conditions and thus detectvulnerabilities.The experimental results, using a benchmark suite comprising ninediverse and representative Web applications, show that our approach(implemented in the JOACO tool) is significantly more effective atdetecting injection vulnerabilities than state-of-the-art approaches,achieving 98% recall, without producing any false alarm. We alsocompared the constraint solving module of our approach withstate-of-the-art constraint solvers, using five different benchmarksuites; our approach correctly solved the highest number ofconstraints (43177 out of 43184), without producing any incorrectresult, and was the one with the least number of time-out/failingcases. In both scenarios, the execution time was practicallyacceptable, given the offline nature of vulnerability detection.