Logic flaws within web applications will allow malicious operations to be triggered towards back-end database. Existing approaches to identifying logic flaws of database accesses are strongly tied to structured query ...Logic flaws within web applications will allow malicious operations to be triggered towards back-end database. Existing approaches to identifying logic flaws of database accesses are strongly tied to structured query language （SQL） statement construction and cannot be applied to the new generation of web applications that use not only structured query language （NoSQL） databases as the storage tier. In this paper, we present Lom, a black-box approach for discovering many categories of logic flaws within MongoDB- based web applications. Our approach introduces a MongoDB operation model to support new features of MongoDB and models the application logic as a mealy finite state machine. During the testing phase, test inputs which emulate state violation attacks are constructed for identifying logic flaws at each application state. We apply Lom to several MongoDB-based web applications and demonstrate its effectiveness.展开更多
针对面向服务功能的语义Web服务组合问题,特别是经典的人工智能规划方法无法有效地处理Web服务执行过程中动态产生的新个体,以及基于服务匹配的方法则无法充分利用服务I/O参数类型之间大量的语义关联等关键问题,通过动态逻辑和描述逻辑...针对面向服务功能的语义Web服务组合问题,特别是经典的人工智能规划方法无法有效地处理Web服务执行过程中动态产生的新个体,以及基于服务匹配的方法则无法充分利用服务I/O参数类型之间大量的语义关联等关键问题,通过动态逻辑和描述逻辑之间的对比研究,采用描述逻辑公理来刻画Web服务的IOPR(inputs,outputs,precondilions and results),扩展了基于动态逻辑的人工智能规划方法,提出了把语义Web服务组合问题转化为描述逻辑推理问题的方法,克服了经典的人工智能规划方法中的困难和基于服务匹配的服务组合方法的缺点.展开更多
基金supported by China Scholarship Council,Tianjin Science and Technology Committee(No.12JCZDJC20800)Science and Technology Planning Project of Tianjin(No.13ZCZDGX01098)+2 种基金NSF TRUST(The Team for Research in Ubiquitous Secure Technology)Science and Technology Center(No.CCF-0424422)National High Technology Research and Development Program of Chia(863Program)(No.2013BAH01B05)National Natural Science Foundation of China(No.61402264)
文摘Logic flaws within web applications will allow malicious operations to be triggered towards back-end database. Existing approaches to identifying logic flaws of database accesses are strongly tied to structured query language （SQL） statement construction and cannot be applied to the new generation of web applications that use not only structured query language （NoSQL） databases as the storage tier. In this paper, we present Lom, a black-box approach for discovering many categories of logic flaws within MongoDB- based web applications. Our approach introduces a MongoDB operation model to support new features of MongoDB and models the application logic as a mealy finite state machine. During the testing phase, test inputs which emulate state violation attacks are constructed for identifying logic flaws at each application state. We apply Lom to several MongoDB-based web applications and demonstrate its effectiveness.
文摘针对面向服务功能的语义Web服务组合问题,特别是经典的人工智能规划方法无法有效地处理Web服务执行过程中动态产生的新个体,以及基于服务匹配的方法则无法充分利用服务I/O参数类型之间大量的语义关联等关键问题,通过动态逻辑和描述逻辑之间的对比研究,采用描述逻辑公理来刻画Web服务的IOPR(inputs,outputs,precondilions and results),扩展了基于动态逻辑的人工智能规划方法,提出了把语义Web服务组合问题转化为描述逻辑推理问题的方法,克服了经典的人工智能规划方法中的困难和基于服务匹配的服务组合方法的缺点.
