Symbolic Model Extraction for Web Application Verification

Bocic, Ivan; Bultan, Tevfik

doi:10.1109/icse.2017.72

Cited by 6 publications

(4 citation statements)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In recent years, Z3 [33] has been commonly used in analysis using formal methods [34]- [36]. Bocić and Bultan [37] used Z3 in web-related analysis and showed the model extraction for the Rails. However, Z3 is based on command lines and its outputs are in text format, and thus analysis of results obtained from complicated models, such as the web, needs significant effort.…”

Section: ) State-of-the-art Formal Methodsmentioning

confidence: 99%

Towards Further Formal Foundation of Web Security: Expression of Temporal Logic in Alloy and Its Application to a Security Model With Cache

et al. 2019

View full text Add to dashboard Cite

Security analysis of a web system is complicated, and thus analysis using formal methods to describe system specification mathematically has attracted attention. Some previous studies have adopted formal methods, but their models cannot express parallel communication completely. This limitation gives rise to problems where web functions, such as a cache that stores contents, cannot be defined and attacks that forge contents cannot be analyzed. These problems are present in the Alloy-based implementations of current models that do not have the ability to express temporal logic. Therefore, we design implementation and evaluation of temporal logic in Alloy to express time series and parallel computation for web security analysis. In doing so, state transitions in the web can be expressed by fitting them in our proposed syntax. As concrete applications, we describe a web security model that includes caches and show that our proposed syntax can analyze state-of-the-art attacks, such as unauthorized access to users' account pages via caches. The source code of our proposed model in Alloy is publicly available.INDEX TERMS Alloy, cache, formal methods, security model, temporal logic, web security. I. INTRODUCTION A. BACKGROUND

show abstract

Section: ) State-of-the-art Formal Methodsmentioning

confidence: 99%

Towards Further Formal Foundation of Web Security: Expression of Temporal Logic in Alloy and Its Application to a Security Model With Cache

et al. 2019

View full text Add to dashboard Cite

show abstract

“…Model Extraction: There have been some interest in (semi-)automatically extracting models from software, which include extraction of relationships between features and computational units [46], object models [47], [48], finitestate models [49], [50], [51], dependence models [52], test scenarios conforming to some temporal logic formula defined over a data-flow graph [53], state predicates to guide state exploration of a cooperating model checker [54], a statistical language model [55], framework models for symbolic execution [56], symbolic data models for web applications [57], and behavioral models for USB firmware [13]. Our approach uses symbolic execution to extract protocol relevant constraints from firmware and it uses these constraints to learn a constraint-based model for the protocol of interest.…”

Section: Related Workmentioning

confidence: 99%

ProXray: Protocol Model Learning and Guided Firmware Analysis

Fowze

Tian

Hernandez

et al. 2019

IIEEE Trans. Software Eng.

View full text Add to dashboard Cite

The number of Internet of Things (IoT) has reached 7 billion globally in early 2018 and are nearly ubiquitous in daily life. Knowing whether or not these devices are safe and secure to use is becoming critical. IoT devices usually implement communication protocols such as USB and Bluetooth within firmware to allow a wide range of functionality. Thus analyzing firmware using domain knowledge from these protocols is vital to understand device behavior, detect implementation bugs, and identify malicious components. Unfortunately, due to the complexity of these protocols, there is usually no formal specification available that can help automate the firmware analysis; as a result significant manual effort is currently required to study these protocols and to reverse engineer the device firmware. In this paper, we propose a new firmware analysis methodology using symbolic execution called ProXray, which can learn a protocol model from known firmware, and apply the model to recognize the protocol relevant fields and detect functionality within unknown firmware automatically. After the training phase, ProXray can fully automate the firmware analysis process while supporting user's queries in the form of protocol relevant constraints. We have applied ProXray to the USB and the Bluetooth protocols by learning protocol constraint models from firmware that implement these protocols. We are then able to map protocol fields and identify USB functionality automatically within all 6 unknown USB firmware while achieving more than an order of magnitude speedup in reaching protocol relevant targets in unknown Bluetooth firmware. Our model achieved high coverage of the USB and Bluetooth specifications for several important protocol fields. ProXray provides a new method to apply domain knowledge to firmware analysis automatically.

show abstract

“…Model-based Software Engineering: The use of models in software engineering has enabled diverse applications such as program verification [15], testing [18], generation [47], and reuse [35]. The user may be tasked with providing a model specification written in a higher-level language, or a simplified model may be extracted automatically (if the target software already exists for analysis or execution).…”

Section: Related Workmentioning

confidence: 99%

Active learning for software engineering

Cambronero

Dang

Vasilakis

et al. 2019

Proceedings of the 2019 ACM SIGPLAN International Symposium on New Ideas, New Paradigms, and Reflections on Programming and Sof

View full text Add to dashboard Cite

Software applications have grown increasingly complex to deliver the features desired by users. Software modularity has been used as a way to mitigate the costs of developing such complex software. Active learning-based program inference provides an elegant framework that exploits this modularity to tackle development correctness, performance and cost in large applications. Inferred programs can be used for many purposes, including generation of secure code, code re-use through automatic encapsulation, adaptation to new platforms or languages, and optimization. We show through detailed examples how our approach can infer three modules in a representative application. Finally, we outline the broader paradigm and open research questions. CCS Concepts • Software and its engineering → Software development techniques.

show abstract

Symbolic Model Extraction for Web Application Verification

Cited by 6 publications

References 22 publications

Towards Further Formal Foundation of Web Security: Expression of Temporal Logic in Alloy and Its Application to a Security Model With Cache

Towards Further Formal Foundation of Web Security: Expression of Temporal Logic in Alloy and Its Application to a Security Model With Cache

ProXray: Protocol Model Learning and Guided Firmware Analysis

Active learning for software engineering

Contact Info

Product

Resources

About