اخبار و اعلانات

 آمار

تعداد نشریات43
تعداد شماره‌ها1,685
تعداد مقالات13,783
تعداد مشاهده مقاله32,318,933
تعداد دریافت فایل اصل مقاله12,777,014
Alidoosti, Mitra, Nowroozi, Alireza, Nickabadi, Ahmad. (1398). BLProM: A black-box approach for detecting business-layer processes in the web applications. , 6(2), 65-80. doi: 10.22108/jcs.2020.117223.1028
Mitra Alidoosti; Alireza Nowroozi; Ahmad Nickabadi. "BLProM: A black-box approach for detecting business-layer processes in the web applications". , 6, 2, 1398, 65-80. doi: 10.22108/jcs.2020.117223.1028
Alidoosti, Mitra, Nowroozi, Alireza, Nickabadi, Ahmad. (1398). 'BLProM: A black-box approach for detecting business-layer processes in the web applications', , 6(2), pp. 65-80. doi: 10.22108/jcs.2020.117223.1028
Alidoosti, Mitra, Nowroozi, Alireza, Nickabadi, Ahmad. BLProM: A black-box approach for detecting business-layer processes in the web applications. , 1398; 6(2): 65-80. doi: 10.22108/jcs.2020.117223.1028

BLProM: A black-box approach for detecting business-layer processes in the web applications

Journal of Computing and Security
مقاله 4، دوره 6، شماره 2، مهر 2019، صفحه 65-80    اصل مقاله (704.34 K)
نوع مقاله: Research Article
شناسه دیجیتال (DOI): 10.22108/jcs.2020.117223.1028
نویسندگان
Mitra Alidoosti1؛ Alireza Nowroozi* 1؛ Ahmad Nickabadi2
1Malek-Ashtar University of technology, Tehran, Iran.
2Amirkabir University of Tehran, Tehran, Iran.
چکیده
Web application vulnerability scanners cannot detect business logic vulnerabilities (vulnerabilities related to logic) because they are not able to understand the business logic of the web application. To identify the business logic of the web application, this paper presents BLProM, Business-Layer Process Miner, the black-box approach that identifies business processes of the web application. Detecting business processes of the web applications can be used in dynamic security testing to identify business logic vulnerabilities in web applications. BLProM first extracts the navigation graph of the web application then identifies business processes from the navigation graph. The evaluation conducted on three well-known open-source web applications shows that BLProM can detect business logic processes. Experimental results show that BLProM improves web application scanning because it clusters web application pages and prevents scanning similar pages. The proposed approach is compared to OWASP ZAP, an open-source web scanner. We show that BLProM improves web application scanning about %96.
کلیدواژه‌ها
Business layer؛ business process؛ navigation graph
سایر فایل های مرتبط با مقاله
مراجع
[1] Common vulnerabilities and exposures. https://cve.mitre.org/cve/cve.html. [ bib ]
[2] 2015 ITRC. Identity Theft Resource Center Breach Report Hits Near Record High in 2015. http://www.idtheftcenter.org/ITRC-Surveys-Studies/2015databreaches.html, Accessed Feb, 2017. [ bib ]
[3] G. Pellegrino and D. Balzarotti. Toward Black-Box Detection of Logic Flaws in Web Applications. In Network and Distributed System Security symposium 2014 (NDSS2014), 2014. [ bib | DOI ]
[4] Testing for business logic, OWASP. https://www.owasp.org/index.php/Testing_for_business_logic, Accessed Feb, 2017. [ bib ]
[5] D. Balzarotti, M. Cova, V. Felmetsger, and G. Vigna. Multi-module vulnerability analysis of web-based applications. In Proceedings of the 14th ACM conference on Computer and communications security, page 25–35. ACM, 2007. [ bib | DOI ]
[6] A. Doupé, B. Boe, C. Kruegel, and G. Vigna. Fear the EAR: discovering and mitigating execution after redirect vulnerabilities. In Proceedings of the 18th ACM conference on Computer and communications security, page 251–262. ACM, 2011. [ bib | DOI ]
[7] V. Felmetsger, L. Cavedon, C. Kruegel, and G. Vigna. Business Logic Attacks – Bots and BATs, OWASP, 2009. In USENIX Security Symposium, 2010. [ bib ]
[8] E. Chai. Business Logic Attacks – Bots and BATs, OWASP, 2009. https://www.owasp.org/images/a/aa/OWASP_Cincinnati_Jan_2011.pdf, Accessed Feb. 2017. [ bib ]
[9] X. Li and Y. Xue. BLOCK: a black-box approach for detection of state violation attacks towards web applications. In Proceedings of the 27th Annual Computer Security Applications Conference, page 247–256, 2011. [ bib | DOI ]
[10] M. Cova, D. Balzarotti, V. Felmetsger, and G. Vigna. Swaddler: An Approach for the Anomaly-Based Detection of State Violations in Web Applications. In Giovanni, pages 63--86. Springer, Berlin, Heidelberg, 2007. [ bib | DOI ]
[11] X. Li, W. Yan, and Y. Xue. SENTINEL: securing database from logic flaws in web applications. In Proceedings of the second ACM conference on Data and Application Security and Privacy, page 25–36, 2012. [ bib | DOI ]
[12] M. Alidoosti and A. Nowroozi. BLDAST: business-layer Dynamic Application Security Tester of the web application in order to detect web application vulnerabilities against flooding DoS attacks. In Iran Society of Cryptology Conference, shiraz, Iran. in Persian, 2017. [ bib ]
[13] M. Alidoosti, A. Nowroozi, and A. Nickabadi. Evaluating the Web-Application Resiliency to Business-Layer DoS Attacks. ETRI Journal, 2019. [ bib | DOI ]
[14] M. Alidoosti and A. Nowroozi. BLTOCTTOU: business-layer dynamic application security tester of the web application in order to detect web application vulnerabilities against Race Condition attacks. In Computer Society of Iran Conference, Tehran, Iran. in Persian, 2018. [ bib ]
[15] M. Alidoosti and A. Nowroozi. BLProM: Business-layer process miner of the web application. In ISCISC, pages 1--6. IEEE, 2018. [ bib | DOI ]
[16] V. Crescenzi, P. Merialdo, and P. Missier. Clustering Web pages based on their structure. Data & Knowledge Engineering, 54(3):279--299, 2005. [ bib | DOI ]
آمار
تعداد مشاهده مقاله: 399
تعداد دریافت فایل اصل مقاله: 378


سامانه مدیریت نشریات علمی. طراحی و پیاده سازی از سیناوب