Countering code injection attacks: a unified approach.
Saved in:
| Title: | Countering code injection attacks: a unified approach. |
|---|---|
| Authors: | Mitropoulos, Dimitris, Karakoidas, Vassilios, Louridas, Panagiotis, Spinellis, Diomidis |
| Source: | Information Management & Computer Security; 2011, Vol. 19 Issue 3, p177-194, 18p |
| Subject Terms: | INTERNET security, COMPUTER security, DATA security, COMPUTER crimes, SQL, XML (Extensible Markup Language), JAVASCRIPT programming language, MALWARE |
| Abstract: | Purpose – The purpose of this paper is to propose a generic approach that prevents a specific class of code injection attacks (CIAs) in a novel way. Design/methodology/approach – To defend against CIAs this approach involves detecting attacks by using location-specific signatures to validate code statements. The signatures are unique identifiers that represent specific characteristics of a statement's execution. The key property that differentiates the scheme presented in this paper is that these characteristics do not depend entirely on the code statement, but also take into account elements from its execution context. Findings – The approach was applied successfully to defend against attacks targeting structured query language (SQL), XML Path Language and JavaScript with positive results. Originality/value – Despite many countermeasures that have been proposed the number of CIAs has been increasing. Malicious users seem to find new ways to introduce compromised embedded executable code to applications by using a variety of languages and techniques. Hence, a generic approach that defends against such attacks would be a useful countermeasure. This approach can defend attacks that involve both domain-specific languages (e.g. SQL) and general purpose languages (e.g. JavaScript) and can be used both against client-side and server-side attacks. [ABSTRACT FROM AUTHOR] |
| Copyright of Information Management & Computer Security is the property of Emerald Publishing Limited and its content may not be copied or emailed to multiple sites without the copyright holder's express written permission. Additionally, content may not be used with any artificial intelligence tools or machine learning technologies. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.) | |
| Database: | Complementary Index |
Nájsť tento článok vo Web of Science Be the first to leave a comment!