Runtime Protection

To improve the security of web applications, I developed techniques to detect and prevent SQL Injection Attacks (SQLIA). This type of attack exploits a web application's vulnerable input fields so that an attacker's commands are executed by an application's underlying database. The first technique that I developed, amnesia, uses static analysis to model the possible legal SQL queries that a web application can generate and then monitors the application at run-time to ensure that each executed query matches the model. The empirical evaluation of amnesia showed that it is a highly effective technique for preventing SQLIAs. However, the analysis does not scale well for large web applications and it is difficult to precisely model all possible database queries. I developed a new technique, wasp, that does not have these limitations. This technique uses positive tainting that tracks "trusted" strings in an application and performs a syntax-aware evaluation on each database query before it is executed to ensure that only trusted strings are used to form sensitive parts of a query, such as keywords and operators. Both the positive tainting and syntax-aware evaluation can be customizable with developer-provided specifications, which makes the approach widely applicable. In the empirical evaluation of this technique, I evaluated wasp on a set of ten web application and with over 24,000 attacks and legitimate accesses. wasp was able to stop all of the attacks without generating any false positives.

Papers related to Runtime Protection:

WASP: Protecting Web Applications Using Positive Tainting and Syntax-Aware Evaluation
W. Halfond, A. Orso and P. Manolios
IEEE Transactions on Software Engineering.
Detection and Prevention of SQL Injection Attacks
W. Halfond and A. Orso
Malware Detection, Series: Advances in Information Security, Springer, Vol. 27
Using Positive Tainting and Syntax-Aware Evaluation to Counter SQL Injection Attacks
W. Halfond, A. Orso and P. Manolios
Foundations of Software Engineering (FSE 2006)
Preventing SQL Injection Attacks Using AMNESIA
W. Halfond and A. Orso
International Conference on Software Engineering (ICSE 2006) - Formal Demo
AMNESIA: Analysis and Monitoring for NEutralizing SQL-Injection Attacks
W. Halfond and A. Orso
Automated Software Engineering (ASE 2005)
Combining Static Analysis and Runtime Monitoring to Counter SQL-Injection Attacks
W. Halfond and A. Orso
Workshop on Dynamic Analysis (WODA 2005)