SMask: Preventing Injection Attacks in Web Applications by Approximating Automatic Data/Code Separation

被引：0

作者：

Johns, Martin ^{[1
]}

Beyerlein, Christian ^{[1
]}

机构：

[1] Univ Hamburg, Dept Informat, D-22527 Hamburg, Germany

来源：

APPLIED COMPUTING 2007, VOL 1 AND 2 | 2007年

关键词：

Code Injection; Web Application;

D O I：

暂无

中图分类号：

TP39 [计算机的应用];

学科分类号：

081203 ; 0835 ;

摘要：

Web applications employ a heterogeneous set of programming languages: the language that was used to write the application's logic and several supporting languages. Supporting languages are e.g., server-side languages for data management like SQL and client-side interface languages such as HTML and JavaScript. These languages are handled as string values by the application's logic. Therefore, no syntactic means exists to differentiate between executable code and generic data. This circumstance is the root of most code injection vulnerabilities: Attackers succeed in providing malicious data that is executed by the application as code. In this paper we introduce SMask, a novel approach towards approximating data/code separation. By using string masking to persistently mark legitimate code in string values, SMask is able to identify code that was injected during the processing of an http request. SMask works transparently to the application and is implementable either by integration in the application server or by source-to-source translation using code instrumentation.

引用

页码：284 / 291

页数：8

共 50 条

[31] Mitigation of false data injection attacks on automatic generation control considering nonlinearities
Ayad, Abdelrahman
Khalaf, Mohsen
Salama, Magdy
El-Saadany, Ehab F.
ELECTRIC POWER SYSTEMS RESEARCH, 2022, 209
[32] Secured Web Application Using Combination of Query Tokenization and Adaptive Method in Preventing SQL Injection Attacks
Abu Othman, Noor Ashitah
Ali, Fakariah Hani Mohd
Noh, Mashyum Binti Mohd
2014 INTERNATIONAL CONFERENCE ON COMPUTER, COMMUNICATIONS, AND CONTROL TECHNOLOGY (I4CT), 2014, : 472 - 476
[33] Multiclass False Data Injection Attacks Detection and Classification in Automatic Generation Control
Alshareef, Sami M.
2024 IEEE CANADIAN CONFERENCE ON ELECTRICAL AND COMPUTER ENGINEERING, CCECE 2024, 2024, : 458 - 463
[34] Modeling and Mitigating Impact of False Data Injection Attacks on Automatic Generation Control
Tan, Rui
Nguyen, Hoang Hai
Foo, Eddy. Y. S.
Yau, David K. Y.
Kalbarczyk, Zbigniew
Iyer, Ravishankar K.
Gooi, Hoay Beng
IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, 2017, 12 (07) : 1609 - 1624
[35] Detecting SQL Injection Web Attacks Using Ensemble Learners and Data Sampling
Zuech, Richard
Hancock, John
Khoshgoftaar, Taghi M.
PROCEEDINGS OF THE 2021 IEEE INTERNATIONAL CONFERENCE ON CYBER SECURITY AND RESILIENCE (IEEE CSR), 2021, : 27 - 34
[36] Data-Driven Resilient Automatic Generation Control Against False Data Injection Attacks
Chen, Chunyu
Chen, Yang
Zhao, Junbo
Zhang, Kaifeng
Ni, Ming
Ren, Bixing
IEEE TRANSACTIONS ON INDUSTRIAL INFORMATICS, 2021, 17 (12) : 8092 - 8101
[37] Separation of navigation routing code in J2EE web applications
Han, M
Hofmeister, C
WEB ENGINEERING, PROCEEDINGS, 2005, 3579 : 221 - 231
[38] Counterfeit object-oriented programming: On the difficulty of preventing code reuse attacks in C++ applications
Horst Görtz Institut , Ruhr-Universität Bochum, Germany
不详
Proc. IEEE Symp. Secur. Privacy, (745-762):
[39] Detecting command injection attacks in web applications based on novel deep learning methods
Wang, Xinyu
Zhai, Jiqiang
Yang, Hailu
SCIENTIFIC REPORTS, 2024, 14 (01):
[40] Protecting Web Applications from SQL Injection Attacks by using Framework and Database Firewall
Manikanta, Yakkala V. Naga
Sardana, Anjali
PROCEEDINGS OF THE 2012 INTERNATIONAL CONFERENCE ON ADVANCES IN COMPUTING, COMMUNICATIONS AND INFORMATICS (ICACCI'12), 2012, : 609 - 613

← 1 2 3 4 5 →