Security Relevancy Analysis on the Registry of Windows NT 4.0

Many security breaches are caused by inappropriate inputs crafted by people with malicious intents. To enhance the system security, we need either to ensure that inappropriate inputs are filtered out by the program, or to ensure that only trusted people can access those inputs. In the second approach, we sure do not want to put such constraint on every input, instead, we only want to restrict the access to the security relevant inputs. The goal of this paper is to investigate how to identify which inputs are relevant to system security. We formulate the problem as an security relevancy problem, and deploy static analysis technique to identify security relevant inputs. Our approach is based on dependency analysis technique; it identifies if the behavior of any security critical action depends on certain input. If such a dependency relationship exists, we say that the input is security relevant, otherwise, we say the input is security non-relevant. This technique is applied to a securit...

• Type: Conference
• Year: 1999
• Where: ACSAC
• Authors: Wenliang Du, Praerit Garg, Aditya P. Mathur
• Keywords: ACSAC 1999, Inappropriate Inputs, Security, Security Privacy, Security Relevant Inputs