The Experts below are selected from a list of 87 Experts worldwide ranked by ideXlab platform

Tevfik Bultan - One of the best experts on this subject based on the ideXlab platform.

  • Patching vulnerabilities with sanitization synthesis
    2011 33rd International Conference on Software Engineering (ICSE), 2011
    Co-Authors: Fang Yu, Muath Alkhalaf, Tevfik Bultan
    Abstract:

    We present automata-based static string analysis techniques that automatically generate sanitization statements for patching vulnerable web applications. Our approach consists of three phases: Given an attack pattern we first conduct a Vulnerability analysis to identify if strings that match the attack pattern can reach the security-sensitive functions. Next, we compute Vulnerability signatures that characterize all input strings that can exploit the Discovered Vulnerability. Given the Vulnerability signatures, we then construct sanitization statements that 1) check if a given input matches the Vulnerability signature and 2) modify the input in a minimal way so that the modified input does not match the Vulnerability signature. Our approach is capable of generating relational Vulnerability signatures (and corresponding sanitization statements) for vulnerabilities that are due to more than one input.

  • ICSE - Patching vulnerabilities with sanitization synthesis
    Proceeding of the 33rd international conference on Software engineering - ICSE '11, 2011
    Co-Authors: Fang Yu, Muath Alkhalaf, Tevfik Bultan
    Abstract:

    We present automata-based static string analysis techniques that automatically generate sanitization statements for patching vulnerable web applications. Our approach consists of three phases: Given an attack pattern we first conduct a Vulnerability analysis to identify if strings that match the attack pattern can reach the security-sensitive functions. Next, we compute Vulnerability signatures that characterize all input strings that can exploit the Discovered Vulnerability. Given the Vulnerability signatures, we then construct sanitization statements that 1) check if a given input matches the Vulnerability signature and 2) modify the input in a minimal way so that the modified input does not match the Vulnerability signature. Our approach is capable of generating relational Vulnerability signatures (and corresponding sanitization statements) for vulnerabilities that are due to more than one input.

K. Levitt - One of the best experts on this subject based on the ideXlab platform.

  • Detecting and defending against Web-server fingerprinting
    18th Annual Computer Security Applications Conference 2002. Proceedings., 2002
    Co-Authors: J. Rowe, C. Ko, K. Levitt
    Abstract:

    Cyber attacks continue to increase in sophistication. Advanced attackers often gather information about a target system before launching a precise attack to exploit a Discovered Vulnerability. This paper discusses techniques for remote identification of web servers and suggests possible defenses to the probing activity. General concepts of finger-printing and their application to the identification of Web servers, even where server information has been omitted are described and methodologies for detecting and limiting such activity are discussed.

Amani S. Ibrahim - One of the best experts on this subject based on the ideXlab platform.

  • ASE - Supporting automated Vulnerability analysis using formalized Vulnerability signatures
    Proceedings of the 27th IEEE ACM International Conference on Automated Software Engineering - ASE 2012, 2012
    Co-Authors: Mohamed Almorsy, John Grundy, Amani S. Ibrahim
    Abstract:

    Adopting publicly accessible platforms such as cloud computing model to host IT systems has become a leading trend. Although this helps to minimize cost and increase availability and reachability of applications, it has serious implications on applications’ security. Hackers can easily exploit vulnerabilities in such publically accessible services. In addition to, 75% of the total reported application vulnerabilities are web application specific. Identifying such known vulnerabilities as well as newly Discovered vulnerabilities is a key challenging security requirement. However, existing Vulnerability analysis tools cover no more than 47% of the known vulnerabilities. We introduce a new solution that supports automated Vulnerability analysis using formalized Vulnerability signatures. Instead of depending on formal methods to locate Vulnerability instances where analyzers have to be developed to locate specific vulnerabilities, our approach incorporates a formal Vulnerability signature described using OCL. Using this formal signature, we perform program analysis of the target system to locate signature matches (i.e. signs of possible vulnerabilities). A newly–Discovered Vulnerability can be easily identified in a target program provided that a formal signature for it exists. We have developed a prototype static Vulnerability analysis tool based on our formalized Vulnerability signatures specification approach. We have validated our approach in capturing signatures of the OWSAP Top10 vulnerabilities and applied these signatures in analyzing a set of seven benchmark applications.

  • Supporting automated Vulnerability analysis using formalized Vulnerability signatures
    2012 Proceedings of the 27th IEEE ACM International Conference on Automated Software Engineering, 2012
    Co-Authors: Mohamed Almorsy, John Grundy, Amani S. Ibrahim
    Abstract:

    Adopting publicly accessible platforms such as cloud computing model to host IT systems has become a leading trend. Although this helps to minimize cost and increase availability and reachability of applications, it has serious implications on applications' security. Hackers can easily exploit vulnerabilities in such publically accessible services. In addition to, 75% of the total reported application vulnerabilities are web application specific. Identifying such known vulnerabilities as well as newly Discovered vulnerabilities is a key challenging security requirement. However, existing Vulnerability analysis tools cover no more than 47% of the known vulnerabilities. We introduce a new solution that supports automated Vulnerability analysis using formalized Vulnerability signatures. Instead of depending on formal methods to locate Vulnerability instances where analyzers have to be developed to locate specific vulnerabilities, our approach incorporates a formal Vulnerability signature described using OCL. Using this formal signature, we perform program analysis of the target system to locate signature matches (i.e. signs of possible vulnerabilities). A newly-Discovered Vulnerability can be easily identified in a target program provided that a formal signature for it exists. We have developed a prototype static Vulnerability analysis tool based on our formalized Vulnerability signatures specification approach. We have validated our approach in capturing signatures of the OWSAP Top10 vulnerabilities and applied these signatures in analyzing a set of seven benchmark applications.

Scott A. Smolka - One of the best experts on this subject based on the ideXlab platform.

  • formal analysis of the kaminsky dns cache poisoning attack using probabilistic model checking
    High-Assurance Systems Engineering, 2010
    Co-Authors: Nikolaos Alexiou, Panagiotis Katsaros, Tushar Dashpande, Stylianos Basagiannis, Scott A. Smolka
    Abstract:

    We use the probabilistic model checker PRISM to formally model and analyze the highly publicized Kaminsky DNS cache-poisoning attack. DNS (Domain Name System) is an internet-wide, hierarchical naming system used to translate domain names such as google.com into physical IP addresses such as 208.77.188.166. The Kaminsky DNS attack is a recently Discovered Vulnerability in DNS that allows an intruder to hijack a domain, i.e. corrupt a DNS server so that it replies with the IP address of a malicious web server when asked to resolve URLs within a non-malicious domain such as google.com. A proposed fix for the attack is based on the idea of randomizing the source port a DNS server uses when issuing a query to another server in the DNS hierarchy. We use PRISM to introduce a Continuous Time Markov Chain representation of the Kaminsky attack and the proposed fix, and to perform the required probabilistic model checking. Our results, gleaned from more than 240 PRISM runs, formally validate the existence of the Kaminsky cache-poisoning attack even in the presence of an intruder with virtually no knowledge of the victim DNS server's actions. They also serve to quantify the effectiveness of the proposed fix: using nonlinear least-squares curve fitting, we show that the probability of a successful attack obeys a 1/N distribution, where N is the upper limit on the range of source-port ids. We also demonstrate an increasing attack probability with an increasing number of attempted attacks or increasing rate at which the intruder guesses the source-port id.

  • HASE - Formal Analysis of the Kaminsky DNS Cache-Poisoning Attack Using Probabilistic Model Checking
    2010 IEEE 12th International Symposium on High Assurance Systems Engineering, 2010
    Co-Authors: Nikolaos Alexiou, Panagiotis Katsaros, Tushar Dashpande, Stylianos Basagiannis, Scott A. Smolka
    Abstract:

    We use the probabilistic model checker PRISM to formally model and analyze the highly publicized Kaminsky DNS cache-poisoning attack. DNS (Domain Name System) is an internet-wide, hierarchical naming system used to translate domain names such as google.com into physical IP addresses such as 208.77.188.166. The Kaminsky DNS attack is a recently Discovered Vulnerability in DNS that allows an intruder to hijack a domain, i.e. corrupt a DNS server so that it replies with the IP address of a malicious web server when asked to resolve URLs within a non-malicious domain such as google.com. A proposed fix for the attack is based on the idea of randomizing the source port a DNS server uses when issuing a query to another server in the DNS hierarchy. We use PRISM to introduce a Continuous Time Markov Chain representation of the Kaminsky attack and the proposed fix, and to perform the required probabilistic model checking. Our results, gleaned from more than 240 PRISM runs, formally validate the existence of the Kaminsky cache-poisoning attack even in the presence of an intruder with virtually no knowledge of the victim DNS server's actions. They also serve to quantify the effectiveness of the proposed fix: using nonlinear least-squares curve fitting, we show that the probability of a successful attack obeys a 1/N distribution, where N is the upper limit on the range of source-port ids. We also demonstrate an increasing attack probability with an increasing number of attempted attacks or increasing rate at which the intruder guesses the source-port id.

J. Rowe - One of the best experts on this subject based on the ideXlab platform.

  • ACSAC - Detecting and defending against Web-server fingerprinting
    18th Annual Computer Security Applications Conference 2002. Proceedings., 2002
    Co-Authors: J. Rowe, C. Ko, Karl N. Levitt
    Abstract:

    Cyber attacks continue to increase in sophistication. Advanced attackers often gather information about a target system before launching a precise attack to exploit a Discovered Vulnerability. This paper discusses techniques for remote identification of web servers and suggests possible defenses to the probing activity. General concepts of finger-printing and their application to the identification of Web servers, even where server information has been omitted are described and methodologies for detecting and limiting such activity are discussed.

  • Detecting and defending against Web-server fingerprinting
    18th Annual Computer Security Applications Conference 2002. Proceedings., 2002
    Co-Authors: J. Rowe, C. Ko, K. Levitt
    Abstract:

    Cyber attacks continue to increase in sophistication. Advanced attackers often gather information about a target system before launching a precise attack to exploit a Discovered Vulnerability. This paper discusses techniques for remote identification of web servers and suggests possible defenses to the probing activity. General concepts of finger-printing and their application to the identification of Web servers, even where server information has been omitted are described and methodologies for detecting and limiting such activity are discussed.