Static Extraction Of Dataflow Communication For Security

<p>The cost of security vulnerabilities in widely-deployed code such as mobile applications is high. As a result, many companies are using Architectural Risk Analysis (ARA) to find security vulnerabilities before releasing their applications. The existing analyses are focused on finding local coding bugs such as a hard-coded password, rather than architectural flaws such as bypassing the authentication component. During ARA, to find vulnerabilities that are architectural flaws, security architects use a forest-level view of the runtime architecture instead of reading the code. Unfortunately, such a view is often missing from the documentation or is inconsistent with the code. </p> <p>This thesis contributes Scoria, a semi-automated approach for finding architectural flaws that uses a static analysis to extract from code with annotations an approximation of the runtime architecture as an abstract object graph with dataflow edges that refer to abstract objects. The annotations express local, modular hints about architectural tiers, logical containment, and strict encapsulation, such that the extracted object graph is hierarchical, which provides architects with both high-level and detailed understanding of the runtime architecture. Moreover, the abstract object graph is sound such that it has unique representatives for all objects and dataflow communication that may exist at runtime. Architects assisted by Scoria can write as machine-checkable constraints various security policies that are documented only informally. The constraints are in terms of object provenance and indirect communication and can find vulnerabilities missed by constraints that focus only on the presence or the absence of communication, or constraints that track only information flow from sources to sinks. </p> <p>The evaluation consists of expressing several rules from the CERT Secure Coding Standard for Java for which automated detection was previously unavailable. Scoria is also being used to find information disclosure in open-source Android apps. Based on an existing benchmark, Scoria performs better than commercial and research tools in terms of precision and recall. Scoria is thus making Architectural Risk Analysis, which is today mostly manual and informal, a more rigorous, principled and repeatable activity.</p>

Name thesis:degree_name

Ph.D.

Level thesis:degree_level

Open Access Dissertation

Discipline thesis:degree_discipline

Computer Science

Year dc:date.available

2014

Author dc:creator

• Vanciu, Laurentiu Radu

Contributors dc:contributor

• Marwan Abi-Antoun

• abstract object graph
• architectural risk analysis
• dataflow communication
• object provenance
• security constraints
• sound static analysis
• Computer Sciences

Repository record dc:identifier

https://digitalcommons.wayne.edu/oa_dissertations/930

OAI identifier oai:identifier

oai:digitalcommons.wayne.edu:oa_dissertations-1929