Dynamic model extraction and statistical analysis of Web applications

Abstract

The

Finding security bugs in web applications using a catalog of access control patterns

“…Existing work on the application of static analysis to web applications focuses on modeling applications, and especially on building navigation models. Bordbar and Anastasakis [4], for example, model a user's interaction with a web application using UML, and perform bounded verification of properties of that interaction by translating the UML model into Alloy using UML2Alloy; other approaches ( [22,34,29]) perform similar tasks but provide less automation. Nijjar and Bultan [27] translate Rails data models into Alloy to find inconsistencies, but do not examine controller code.…”

Understanding Ajax applications by connecting client and server-side execution traces

“…Early Web application reverse engineering efforts were mainly focused on architecture reconstruction, e.g., (Hassan and Holt 2002;Ricca and Tonella 2001;Di Lucca et al 2002;Tonella et al 2002;Antoniol et al 2004). Static analysis alone does not suffice because of the dynamic nature of Web applications (Tonella et al 2002;Antoniol et al 2004), so in most cases the static analysis is complemented by dynamic analysis.…”

“…Static analysis alone does not suffice because of the dynamic nature of Web applications (Tonella et al 2002;Antoniol et al 2004), so in most cases the static analysis is complemented by dynamic analysis. However, many client-side aspects that are common in Ajax applications are not taken into account.…”

Formal Verification of Web Applications Modeled by Communicating Automata

“…This model, merely a class diagram, is mainly used for the static analysis of web applications: HTML code inspection and scanning, data flow analysis, and semi automatic test case generation. In [31], the above mentioned modeling technique is extended such that a web application is executed to extract models for dynamic web pages using server's access logs. These logs present limited information on the requests since only the request headers are logged.…”