Automated detection, explanation, and remediation of security inconsistencies in Web application access controls using program analysis

使用程序分析自动检测、解释和修复 Web 应用程序访问控制中的安全不一致

• 批准号: RGPIN-2017-05700
• 负责人: Merlo, Ettore
• 金额: $ 1.46万
• 依托单位: École Polytechnique de Montréal
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2019
• 资助国家: 加拿大
• 起止时间: 2019-01-01 至 2020-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=677082
• 关键词: Automated; detection; explanation; remediation; security

The proposed research aims at improving the quality and the security integrity of software, while reducing its development cost in the perspective of application security.******Today's large deployment of Web and mobile applications, cloud services, and cyber-physical systems demand frequent and short release cycles or continuous releases. This puts even more stress and time constraints on quality assurance in general and on application security.******I propose to design, implement, and evaluate automated and scalable methods for the early fault localization and automated repair of security inconsistencies and vulnerabilties in access controls in software applications.******I propose to localize faulty security code by investigating counter-examples from violated policies in security models and to synthesize human-usable explanations.******In this proposal, I want to address and investigate the automated repair of detected security inconsistencies by reasoning on the localized faults that correspond to executions that violate some role-privilege policies.******For example, missing checks could be repaired by automatically inserting proper authorization checks to restore the desired security reachability and accesses to security sensitive resources.******Two problems appear when path based security repair is sought:***(a) selection of code fragments implementing appropriate security checks to be inserted, deleted, or modified to repair the detected inconsistencies.***(b) where to insert the checks along the possibly many paths that violate the security reachability constraints.******In this proposal, I want to address first the problem of automated security repairs and second the problem of optimal placement of required new security checks.******I want to determine the categories of security problems that can be automatically repaired, thus relieving the developers from this burden.***I want to investigate their significance in large industrial or open source systems.******When automation cannot be completely achieved for some inconsistency category, I want to investigate an interactive and recommendation-based strategy to support the developers during their manual repair of inconsistencies by supplying explanations and suggestions.******The proposed research on automated repairs will prevent detected and repaired inconsistencies from being released. Software systems will be more secure and less vulnerable to attacks. The overall process from detection to repaired release will be shorter. Therefore, the window of opportunity for attacks will be dramatically reduced.******Results from this research will be methods and tools available to researchers for automatically analyzing and repairing large applications in the perspective of security. Findings about the effectiveness of automated detection and repair of inconsistencies in large and popular open source applications will also be produced.

拟议的研究旨在提高软件的质量和安全性完整性，同时以应用程序安全的角度降低其开发成本。******今天大量部署网络和移动应用程序，云服务以及网络物理系统需要频繁，短版释放周期或连续发行。这将使整个质量保证的压力和时间限制更大。 ******在这项提案中，我想通过对局部故障进行推理来解决并调查检测到的安全矛盾的自动修复，这些故障对应于违反某些角色策略的执行。寻求安全维修：***（a）选择要插入，删除或修改的适当安全检查以修复检测到的不一致之处的代码片段。***（b）在哪里可以沿着可能违反安全性约束的许多路径插入可能的途径。检查。******我想确定可以自动修复的安全问题类别，从而使开发人员免于这种负担。***我想调查它们在大型工业或开源系统中的重要性。建议。******拟议的自动维修研究将阻止发现和修复的矛盾之处。软件系统将更加安全，并且不太容易受到攻击。从检测到维修释放的总体过程将更短。因此，将大大减少攻击的机会窗口。******这项研究的结果将是研究人员可用的方法和工具，用于在安全角度自动分析和维修大型应用程序。还将产生有关自动检测和修复不一致之处的有效性的结果。