A Field-Sensitive Security Monitor for Object-Oriented Programs

In this paper, we propose a sound method to synthesize a permissive monitor using boolean supervisory controller synthesis that observes a Java program at certain checkpoints, predicts information flow violations and applies suitable countermeasures to prevent violations. We introduce an approach fo...

Celý popis

Uloženo v:
Podrobná bibliografie
Vydáno v:Computers & security Ročník 108; s. 102349
Hlavní autor: Khakpour, Narges
Médium: Journal Article
Jazyk:angličtina
Vydáno: Amsterdam Elsevier Ltd 01.09.2021
Elsevier Sequoia S.A
Témata:
Boolean algebra
Computer Science
Controller synthesis
Datavetenskap
Heap modeling
Information
Information flow
Information flow control
Information sharing
Language-based security
Permissiveness
Security
Sound
Termination
Violations
Information flow control
Controller synthesis
Heap modeling
Language-based security
ISSN:0167-4048, 1872-6208, 1872-6208
On-line přístup:Získat plný text
Tagy: Přidat tag
Žádné tagy, Buďte první, kdo vytvoří štítek k tomuto záznamu!
Popis
Shrnutí:In this paper, we propose a sound method to synthesize a permissive monitor using boolean supervisory controller synthesis that observes a Java program at certain checkpoints, predicts information flow violations and applies suitable countermeasures to prevent violations. We introduce an approach for modeling heap and information flow via heap. To improve permissiveness, we train the monitor and remove false positives by executing the program along with its executable model. If a security violation is detected, the user can define sound countermeasures, including declassification to apply in checkpoints. We prove that the monitored program ensures localized delimited release in case of declassifying information and termination-insensitive noninterference in case of no declassification. We implement a tool to automate the whole process and generate a monitor. Our method is evaluated by applying it on the Droidbench benchmark and one real-life Android application.
Bibliografie:ObjectType-Article-1
SourceType-Scholarly Journals-1
ObjectType-Feature-2
content type line 14
ISSN:0167-4048
1872-6208
1872-6208
DOI:10.1016/j.cose.2021.102349