Abstract:This paper concerns about logic vulnerabilities that result from faulty logic of a web application. Logic vulnerabilities typically accompany with the exposure of unexpected functionalities and lead to the bypass of the intended constraints. From a semantic perspective, logic vulnerabilities occur when mistakes arise in the control flows guarding the processes of invoking critical functionalities. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilities in Java web applications. Logic errors in our approach are characterized as erroneous invocations of functionalities. Program‐slicing technique has been leveraged to capture the processes of invoking critical functionalities. A back‐tracing algorithm is originally designed to extract control flows guarding functionality‐invocation processes. Finally, logic vulnerability detection is transformed into mining abnormal functionality‐invocation processes in a cluster of similar ones by comparing these processes' control flows. We implemented our approach in a prototype tool named logic vulnerability detector and evaluated it on seven real‐world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches. Copyright © 2013 John Wiley & Sons, Ltd. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilitiesin Java web applications. We implemented our approach using program‐slicing technique and a back‐tracingextracting algorithm for control flow, and evaluated it on seven real‐world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches.

A logic-based approach to network security risk assessment

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

Identification of ICS Security Risks Toward the Analysis of Packet Interaction Characteristics Using State Sequence Matching Based on SF-FSM

Static Program Analysis for IoT Risk Mitigation in Space-Air-Ground Integrated Networks

Access Graph Based Risk Assessment Model for Network Information System

Threat Detection in Trigger-Action Programming Rules of Smart Home With Heterogeneous Information Network Model

A markov game theory-based risk assessment model for network information system

Extended Abstract: Access Graph Based Risk Analysis for Network Information System

A novel approach to network vulnerabilities quantitative evaluation based on Mamdani-Style fuzzy logic

Network Security Risk Assessment Framework Based on Tactical Correlation

An Ontology-Based Dynamic Attack Graph Generation Approach for the Internet of Vehicles

Static detection of logic vulnerabilities in Java web applications

Security Analysis of Dynamic SDN Architectures Based on Game Theory

An OVAL-based Active Vulnerability Assessment System for Enterprise Computer Networks.

Automated Security Assessment for the Internet of Things

Intrusion Alerts Correlation Based Assessment of Network Security

Towards Risk Evaluation of Denial-Of-Service Vulnerabilities in Security Protocols

A risk assessment model for enterprise network security

Modelling and Analysis of Network Security - an Algebraic Approach

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach

Modeling and security analysis of enterprise network using attack-defense stochastic game Petri nets