首页|基于博弈的Web应用程序中访问控制漏洞检测方法

基于博弈的Web应用程序中访问控制漏洞检测方法

扫码查看
原文链接
  • 国家科技期刊平台
  • NETL
  • NSTL
  • 万方数据
针对工业互联网中程序的访问控制策略隐藏在源码中难以提取,以及用户的访问操作难以触发所有访问路径而导致逻辑漏洞的通用化检测难以实现的问题,将博弈思想应用于访问控制逻辑漏洞检测中,通过分析不同参与者在Web应用程序中对资源页面的博弈结果来识别漏洞,使得不同用户的访问逻辑能被有针对性地获取.实验结果表明,所提方法在开源的11个程序中检测出31个漏洞,其中8个为未公开的漏洞,漏洞检测覆盖率均超过90%.
Game-based detection method of broken access control vulnerabilities in Web application
To solve the problem that the access control strategy of the program in the industrial Internet was difficult to extract from the source code,and that the user's access operation was difficult to trigger all access paths,which led to the difficulty of universal detection of logical vulnerabilities,game theory was applied to the access control logic vulner-ability detection for the first time.The vulnerabilities were identified by analyzing the game results of different partici-pants on resource pages in the Web application,so that the access logic of different users could be targeted to obtain.Ex-perimental results demonstrate that the proposed method successfully detect 31 vulnerabilities,including 8 unreported ones,out of 11 open-source applications,with a detection range exceeding 90%.

Web application securityvulnerability detectionaccess control vulnerabilityaccess control rulegame

何海涛、许可、杨帅林、张炳、赵宇轩、李嘉政

展开 >

燕山大学信息科学与工程学院,河北 秦皇岛 066004

Web应用程序安全 漏洞检测 访问控制漏洞 访问控制策略 博弈

国家自然科学基金资助项目河北省省级科技计划基金资助项目河北省省级科技计划基金资助项目河北省省级科技计划基金资助项目河北省自然科学基金资助项目河北省自然科学基金资助项目河北省创新能力提升计划基金资助项目河北省高等学校科学技术研究基金资助项目

62376240226Z0701G236Z0702G236Z0304GF2022203026F202220308922567637HBJK2022029

2024

10.11959/j.issn.1000-436x.2024078

通信学报
中国通信学会

通信学报

CSTPCD北大核心
影响因子：1.265
ISSN：1000-436X
年,卷(期)：2024.45(6)