Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation - PLDI '09最新文献

筛选

英文中文

TAJ

Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation - PLDI '09 Pub Date : 1900-01-01 DOI: 10.1145/1542476.1542486

Omer Tripp, Marco Pistoia, Stephen J. Fink, Manu Sridharan, Omri Weisman

{"title":"TAJ","authors":"Omer Tripp, Marco Pistoia, Stephen J. Fink, Manu Sridharan, Omri Weisman","doi":"10.1145/1542476.1542486","DOIUrl":"https://doi.org/10.1145/1542476.1542486","url":null,"abstract":"Taint analysis, a form of information-flow analysis, establishes whether values from untrusted methods and parameters may flow into security-sensitive operations. Taint analysis can detect many common vulnerabilities in Web applications, and so has attracted much attention from both the research community and industry. However, most static taint-analysis tools do not address critical requirements for an industrial-strength tool. Specifically, an industrial-strength tool must scale to large industrial Web applications, model essential Web-application code artifacts, and generate consumable reports for a wide range of attack vectors.\u0000 We have designed and implemented a static Taint Analysis for Java (TAJ) that meets the requirements of industry-level applications. TAJ can analyze applications of virtually any size, as it employs a set of techniques designed to produce useful answers given limited time and space. TAJ addresses a wide variety of attack vectors, with techniques to handle reflective calls, flow through containers, nested taint, and issues in generating useful reports. This paper provides a description of the algorithms comprising TAJ, evaluates TAJ against production-level benchmarks, and compares it with alternative solutions.","PeriodicalId":233896,"journal":{"name":"Proceedings of the 2009 ACM SIGPLAN conference on Programming language design and implementation - PLDI '09","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114602766","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7