The Vulnerability Analysis Framework for Java Bytecode

Abstract

Since Java web applications are used widely in Internet today, the security of it becomes an outstanding problem. The attacks, including SQL injection attack, XSS attack, and etc, are great challenges for the Java application. This paper presents the vulnerability analysis framework to detect the security hole in the Java web applications. The framework combines the techniques of the static points-to dataflow analysis, the dynamical instrument and the fuzzing test. With the cooperation of these static and dynamical analysis techniques, it can improve the efficiency and accuracy of the analysis and lower the false positive rate.

Jar2ontology - A Tool for Automatic Extraction of Semantic Information From Java Object Code

“…(Wong and Gokhale, 2005)), security testing (e.g. (Herbold et al, 2009;Hong et al, 2009;Letarte and Merlo, 2009;Spoto et al, 2010)), software design (e.g. (Amey, 2002)) and reengineering (e.g.…”

“…With respect to object code, we can cite (Hong et al, 2009;Jackson and Waingold, 1999;Spoto et al, 2010) as examples of Java Byte Code analysis. Nevertheless, only one of these approaches (Jackson and Waingold, 1999) is focused on the representation of the semantic knowledge of the analyzed object code, and it only represents the structural component of the model in a UML (Unified Modeling Language) diagram.…”