Research And Implementation Of Java Application Defect Positioning Technology

In recent years, the web security events have occurred frequently,and web security has been widely concerned. SQL Injection and Cross-site scripting (XSS) attack are two of the most common threats.Moreover, attacker could combine a vairty of means of attacks with vulnerabilities to do further attack, which would lead to disclosure of user privacy and even property damage.Common detect detection methods include dynamic analysis and static analysis. Dynamic monitoring tool scans faster while it can not locate the specific codes which cause the vulnerabilities. Static audit tool can locate the specific codes while it has the high rate of false posistives.They all have their own limitations.We propose a novel approach to locate the vulnerabilities which combines static analysis and dynamic analysis, and design system prototype. In static analysis section, we abstractly analyze program using the technology of cloning-based context-sensitive pointer alias analysis, write the corresponding defect rules of these vulnerabilities,and use a reverse defect detection method to do taint analysis. In dynamic analysis section, we use the static analysis results to generate attack vectors for Fuzzing test, monitor the running information of the program and eventually find the vulnerabilitis.Webgoat, bodgeit and other open source code are used to test the JavaVP system. The experimental results show that the system can effectively detect the SQL injection and XSS vulnerabilities, and JavaVP system has a low rate of false positives. The experiment verified the validity of the model and achieved a good result.