SECoverer - Finding Security Vulnerabilities in Web Applications

01.04.2008 - 31.05.2011
Forschungsförderungsprojekt
Web applications have become an important part of today's economic and social life. Unfortunately, these applications are often written by developers who focus on features, operate under stringent time pressure, and have little knowledge of secure programming. As a result, the number and severance of web application vulnerabilities is rising significantly. Only a few tools exist to help programmers and security analyst find web application vulnerabilities. These tools either perform black-box fuzz testing (by exposing the application to a series of malformed inputs) or white-box source code analysis (by statically checking the program for bugs). Unfortunately, these testing tools can only detect a limited set of vulnerability classes. For example, while simple SQL injection vulnerabilities and XSS flaws are often covered, the systems cannot identify more complex logic errors (such as improper authentication or business logic flaws). Also, the tools scale poorly to large code bases and raise many false positives. As a result, most code is still audited manually, if at all. In this project, we propose to develop an analysis platform for web applications. The goal is to use static source code analysis to find vulnerabilities, but to make the detection system ¿work in practice¿. That is, we aim to develop a system that covers a large range of web application flaws, including hard-to-detect bugs such as logic errors. The analysis needs to be precise and efficient, scaling to large programs while raising only a very small amount of false positives. Tools that can detect different classes of vulnerabilities will be integrated as modules into a common analysis framework. This framework supports analysts and programmers by intuitively displaying the identified bugs, providing support for source code management and annotation, and allowing to suppress confirmed false positives.

Personen

Projektleiter_in

Subprojektleiter_in

Projektmitarbeiter_innen

Institut

Contract/collaboration

  • SEC Consult Unternehmensberatung GmbH

Grant funds

  • FFG - Österr. Forschungsförderungs- gesellschaft mbH (National) Austrian Research Promotion Agency (FFG)

Forschungsschwerpunkte

  • Distributed and Parallel Systems: 35%
  • Computer Engineering: 15%
  • Business Informatics: 10%
  • Computational Intelligence: 40%

Schlagwörter

DeutschEnglisch
SicherheitSafety
Web ApplicationsWeb Applicaitons

Publikationen