Sciweavers

Share
ICDE
2009
IEEE

A Static Analysis Framework for Database Applications

11 years 6 months ago
A Static Analysis Framework for Database Applications
—Database developers today use data access APIs such as ADO.NET to execute SQL queries from their application. These applications often have security problems such as SQL injection vulnerabilities and performance problems such as poorly written SQL queries. However today’s compilers have little or no understanding of data access APIs or DBMS, and hence the above problems can go undetected until much later in the application lifecycle. We present a framework that adapts traditional program analysis by leveraging understanding of data access APIs in order to identify such problems early on during application development. Our framework can analyze database application binaries that use ADO.NET data access APIs. We show how our framework can be used for a variety of analysis tasks such as SQL injection detection, workload extraction, identifying performance problems, and verifying data integrity constraints in the application.
Arjun Dasgupta, Vivek R. Narasayya, Manoj Syamala
Added 19 May 2010
Updated 19 May 2010
Type Conference
Year 2009
Where ICDE
Authors Arjun Dasgupta, Vivek R. Narasayya, Manoj Syamala
Comments (0)
books