针对Java Web应用的源码缺陷检测技术研究与实现

发布时间：2018-08-23 10:01

【摘要】：随着互联网技术的不断发展,Web应用项目的不断推广和使用,Web应用的复杂度也在随着提高。为了适应云计算、大数据等新技术的需求,Web系统架构变得越来越复杂,同时也就带来了很多潜在的安全隐患。目前导致软件缺陷存在的主要原因是大多数开发人员将关注点放在了业务实现上,而忽略了编写安全代码的重要性。如果能在开发阶段对软件代码进行检测,及时修正代码中存在的安全缺陷,那么恶意攻击者的可乘之机就会大幅减少。随着JavaEE的迅速发展,Web开源框架得到推广,安全性和保密性较高的大型企业多是基于JavaEE进行软件开发。所以本文对Java Web应用的源码缺陷检测技术进行研究与实现具有一定的现实意义。本文对当前Java Web应用架构进行分析,着重研究了服务器端Java构件的原理和应用场景,包括JSP,Java Servlet和JavaBean。对于Web应用中的高危漏洞SQL注入和XSS跨站脚本攻击的原理和防范进行了深入研究。在源码静态分析部分,创新性地提出了一种双向污点传播分析方法,提高静态分析准确性的同时还能够获取污点数据的传播路径。在程序动态检测部分,创新性地提出了利用静态分析得出的污点传播路径和污点引入点程序切片信息来指导测试用例生成和监测代码植入的方法。并且在深入研究java web应用缺陷检测技术的基础上开发实现了一个针对Java Web应用的源码缺陷检测系统JavaChecker,实验结果表明本文提出的缺陷检测技术能有效的提高结果准确率。
[Abstract]:With the development of Internet technology, the complexity of using Web applications is increasing with the development of Web application projects. In order to adapt to cloud computing, big data and other new technologies are becoming more and more complex, and also bring a lot of potential security risks. The main reason for software defects is that most developers focus on business implementation and ignore the importance of writing secure code. If the software code can be detected in the development stage and the security defects in the code can be corrected in time, the opportunities for malicious attackers will be greatly reduced. With the rapid development of JavaEE, most of the large enterprises with high security and security are based on JavaEE. Therefore, the research and implementation of Java Web application source code defect detection technology has certain practical significance. This paper analyzes the current Java Web application architecture, and focuses on the principle and application scenario of server-side Java components, including JSP Java Servlet and Java Bean. The principle and prevention of high risk vulnerability SQL injection and XSS cross-site script attack in Web application are studied in this paper. In the part of static analysis of source code, a bidirectional stain propagation analysis method is proposed, which can improve the accuracy of static analysis and obtain the propagation path of stain data at the same time. In the part of program dynamic detection, a new method is proposed to guide test case generation and monitor code implantation by using the static analysis of the stain propagation path and the introduction of spot program slicing information. Based on the deep research of java web application defect detection technology, a source code defect detection system for Java Web application, Java Checker, is developed. The experimental results show that the proposed defect detection technology can effectively improve the accuracy of the results.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.09

【参考文献】