{"id":183500,"date":"2006-06-26T00:00:00","date_gmt":"2009-10-31T12:46:18","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/research\/msr-research-item\/improving-software-security-with-precise-static-and-runtime-analysis\/"},"modified":"2016-09-09T09:46:15","modified_gmt":"2016-09-09T16:46:15","slug":"improving-software-security-with-precise-static-and-runtime-analysis","status":"publish","type":"msr-video","link":"https:\/\/www.microsoft.com\/en-us\/research\/video\/improving-software-security-with-precise-static-and-runtime-analysis\/","title":{"rendered":"Improving Software Security with Precise Static and Runtime Analysis"},"content":{"rendered":"<div class=\"asset-content\">\n<p>The landscape of security vulnerabilities has changes dramatically in the last several years. As Web-based applications become more prominent, familiar buffer overruns are far outnumbered by Web application vulnerabilities such as SQL injections and cross-site scripting attacks.<\/p>\n<p>In this talk I introduce a comprehensive static and runtime compiler-based solution to a wide range of Web application vulnerabilities. Our approach targets large real-life Web-based Java applications. Given a vulnerability description, either a static checker or specially instrumented, &#8220;secured&#8221; application bytecode is produced. To make our approach extensible and user-friendly, vulnerability specifications are written in PQL, a Program Query Language [&#8230;].<\/p>\n<p>The static checker generated based on the PQL specification finds vulnerabilities by analyzing the Web-based applications [&#8230;]. The static approach is sound, which ensures that it finds all vulnerabilities captured by the specification in the statically analyzed code. We evaluate analysis features such as context- and object sensitivity that help keep the number of false positives low. We also describe our approach to call graph construction in the presence of reflection [&#8230;].<\/p>\n<p>Alternatively, &#8220;secured&#8221; application executables can be automatically generated based on the same PQL vulnerability specification. Secured executables may be deployed on a standard application server. Furthermore, to improve application uptime, vulnerability recovery rules may be specified. Finally, we show how static analysis can be used to significantly reduce the instrumentation overhead.<\/p>\n<\/div>\n<p><!-- .asset-content --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The landscape of security vulnerabilities has changes dramatically in the last several years. As Web-based applications become more prominent, familiar buffer overruns are far outnumbered by Web application vulnerabilities such as SQL injections and cross-site scripting attacks. In this talk I introduce a comprehensive static and runtime compiler-based solution to a wide range of Web [&hellip;]<\/p>\n","protected":false},"featured_media":195058,"template":"","meta":{"msr-url-field":"","msr-podcast-episode":"","msrModifiedDate":"","msrModifiedDateEnabled":false,"ep_exclude_from_search":false,"_classifai_error":"","msr_hide_image_in_river":0,"footnotes":""},"research-area":[],"msr-video-type":[],"msr-locale":[268875],"msr-post-option":[],"msr-session-type":[],"msr-impact-theme":[],"msr-pillar":[],"msr-episode":[],"msr-research-theme":[],"class_list":["post-183500","msr-video","type-msr-video","status-publish","has-post-thumbnail","hentry","msr-locale-en_us"],"msr_download_urls":"","msr_external_url":"https:\/\/youtu.be\/bCoMj0DAX44","msr_secondary_video_url":"","msr_video_file":"","_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video\/183500","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/types\/msr-video"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video\/183500\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media\/195058"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/media?parent=183500"}],"wp:term":[{"taxonomy":"msr-research-area","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/research-area?post=183500"},{"taxonomy":"msr-video-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-video-type?post=183500"},{"taxonomy":"msr-locale","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-locale?post=183500"},{"taxonomy":"msr-post-option","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-post-option?post=183500"},{"taxonomy":"msr-session-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-session-type?post=183500"},{"taxonomy":"msr-impact-theme","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-impact-theme?post=183500"},{"taxonomy":"msr-pillar","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-pillar?post=183500"},{"taxonomy":"msr-episode","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-episode?post=183500"},{"taxonomy":"msr-research-theme","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/research\/wp-json\/wp\/v2\/msr-research-theme?post=183500"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}