A Field-Sensitive Security Monitor for Object-Oriented Programs

In this paper, we propose a sound method to synthesize a permissive monitor using boolean supervisory controller synthesis that observes a Java program at certain checkpoints, predicts information flow violations and applies suitable countermeasures to prevent violations. We introduce an approach fo...

Full description

Saved in:
Bibliographic Details
Published in:Computers & security Vol. 108; p. 102349
Main Author: Khakpour, Narges
Format: Journal Article
Language:English
Published: Amsterdam Elsevier Ltd 01.09.2021
Elsevier Sequoia S.A
Subjects:
Boolean algebra
Computer Science
Controller synthesis
Datavetenskap
Heap modeling
Information
Information flow
Information flow control
Information sharing
Language-based security
Permissiveness
Security
Sound
Termination
Violations
Information flow control
Controller synthesis
Heap modeling
Language-based security
ISSN:0167-4048, 1872-6208, 1872-6208
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:In this paper, we propose a sound method to synthesize a permissive monitor using boolean supervisory controller synthesis that observes a Java program at certain checkpoints, predicts information flow violations and applies suitable countermeasures to prevent violations. We introduce an approach for modeling heap and information flow via heap. To improve permissiveness, we train the monitor and remove false positives by executing the program along with its executable model. If a security violation is detected, the user can define sound countermeasures, including declassification to apply in checkpoints. We prove that the monitored program ensures localized delimited release in case of declassifying information and termination-insensitive noninterference in case of no declassification. We implement a tool to automate the whole process and generate a monitor. Our method is evaluated by applying it on the Droidbench benchmark and one real-life Android application.
Bibliography:ObjectType-Article-1
SourceType-Scholarly Journals-1
ObjectType-Feature-2
content type line 14
ISSN:0167-4048
1872-6208
1872-6208
DOI:10.1016/j.cose.2021.102349