Sciweavers

Share
ACSAC
2005
IEEE

Dynamic Taint Propagation for Java

10 years 9 months ago
Dynamic Taint Propagation for Java
Improperly validated user input is the underlying root cause for a wide variety of attacks on web-based applications. Static approaches for detecting this problem help at the time of development, but require source code and report a number of false positives. Hence, they are of little use for securing fully deployed and rapidly evolving applications. We propose a dynamic solution that tags and tracks user input at runtime and prevents its improper use to maliciously affect the execution of the program. Our implementation can be transparently applied to Java classfiles, and does not require source code. Benchmarks show that the overhead of this runtime enforcement is negligible and can prevent a number of attacks.
Vivek Haldar, Deepak Chandra, Michael Franz
Added 24 Jun 2010
Updated 24 Jun 2010
Type Conference
Year 2005
Where ACSAC
Authors Vivek Haldar, Deepak Chandra, Michael Franz
Comments (0)
books