Abstract:This paper concerns about logic vulnerabilities that result from faulty logic of a web application. Logic vulnerabilities typically accompany with the exposure of unexpected functionalities and lead to the bypass of the intended constraints. From a semantic perspective, logic vulnerabilities occur when mistakes arise in the control flows guarding the processes of invoking critical functionalities. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilities in Java web applications. Logic errors in our approach are characterized as erroneous invocations of functionalities. Program‐slicing technique has been leveraged to capture the processes of invoking critical functionalities. A back‐tracing algorithm is originally designed to extract control flows guarding functionality‐invocation processes. Finally, logic vulnerability detection is transformed into mining abnormal functionality‐invocation processes in a cluster of similar ones by comparing these processes' control flows. We implemented our approach in a prototype tool named logic vulnerability detector and evaluated it on seven real‐world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches. Copyright © 2013 John Wiley & Sons, Ltd. In this paper, we propose the first lightweight static analysis approach to automatically detect logic vulnerabilitiesin Java web applications. We implemented our approach using program‐slicing technique and a back‐tracingextracting algorithm for control flow, and evaluated it on seven real‐world applications scaled from thousands to million lines of code. The evaluation results show that our approach achieves bigger coverage with acceptable cost and better scalability than previous approaches.

Secure Prolog-Based Mobile Code

Rule-based Website Verification and Repairing Approach

A Hybrid Security Framework of Mobile Code

Securing mobile agents control flow using opaque predicates

Security mechanisms for mobile code in evolutionary networks

Security of mobile agents: a new concept of the integrity protection

Webc: Toward A Portable Framework for Deploying Legacy Code in Web Browsers

Reasoning about inter-procedural security requirements in IoT applications

Mobile Agent Protection Based on Non-Interactive Secure Function Evaluation

An Approach for Modeling and Analyzing Code Mobility.

Static detection of logic vulnerabilities in Java web applications

Using Ontologies to Perform Threat Analysis and Develop Defensive Strategies for Mobile Security

On the use of opaque predicates in mobile agent code obfuscation

Similarity and Logic Based Ontology Mapping for Security Management.

Translating OWL and Semantic Web Rules into Prolog: Moving Toward Description Logic Programs

Ocassionally Secure: A Comparative Analysis of Code Generation Assistants

A Formal Model for Resource Protections in Web Service Applications.

Program Analysis for Mobile Application Integrity and Privacy Enforcement

Robust Safety for Move

Codexity: Secure AI-assisted Code Generation

Plug in the Safety Chip: Enforcing Constraints for LLM-driven Robot Agents