CHAPTER 2 LITERATURE REVIEW
2.1 Content Presentation
CHAPTER 2 LITERATURE REVIEW
2.1 Content Presentation
Research studies have discussed the transformation of content on the big screen of desktop computers to content on the small screens of mobile devices. Ahmadi and Kong (2012) introduced an adaptive layout on the mobile screen based on visual analysis and structural analysis. It provides users with a tool to customize the screen layouts of their mobiles.
At first, it will have page segmentation, including visual analysis and heuristic rules and content analysis. After studying some popular Websites, the researchers found that most Web pages have this pattern in common. The visual analysis is approached using the heuristic rules.
By pixel analysis, a Web page can divide into five sections, which are the top, left menu, right menu, bottom, and main content. Also, it classifies the functionalities of the HTML elements so that it can enclose the semantics of the page content. To provide a user-centric, adaptive layout, the tool will include preprocessing, and it will eliminate all of the elements not necessary to optimize the structure. Then the visible element in the Web page will be resized to fit the mobile screen. Two ways about methods of content presentation were introduced (Ahmadi and Kong, 2012)—narrow -page presentation and multi-page presentation. After giving the advantages and drawbacks, it the Web page decides to take multi-page as its choice. It makes, which requires users to customize their navigation facilities to include overview, search, and shortcut. The set up files will be recorded as XML files so that users can reload themit. It also introduced other tools like Minimap and Gateway. List their advantages and drawbacks and try to integrate with its tool and improve the weakness. Ahmadi and Kong(2012) made an evaluation of their approach and found that the browser with the tables and navigation links did improve efficiency and made
‧
based on four aspects: subjective satisfaction, efficiency, error prevention, and aesthetics. The results showed that users were more satisfied with the SSD v.3 than with the Opera mobile browser except in the category of error prevention. The reason is that the SSD v.3 uses keyword extraction to generate the title of a navigation link. Although the approach shows the advantage of providing users with a customized and adaptive layout on mobile browsers, there are still numerous problems to be solved, including the diversity of the Document Object Model (DOM) structure, the difficulty of dealing with dynamic Web technologies (e.g., Flash), and how mobile device manufacturing companies evaluate the browser.Virpi et al. (2006) gave the principles about content presentation on mobile devices.
Instead of focusing the effort on transformations, we need to obey their principles to improve the usability and performance of the content display of the application on the mobile device. Ahmadi and Kong (2012) suggested using hierarchical links and navigations to deal with cases that have many contents in the screen. Gateway (Mackay, 2003) reduced its page scale so that users would not have to do too much vertical and horizontal scrolling, which they thought would cause them to become frustrated.
In order to display original content from Web pages on mobile devices, some elements have to be removed. Such elements can be formatting style, dynamic objects, or animation effects, which may increase the effort of processing the content. Presentation of content on mobile devices is totally different from that of Web pages, which provide users not only with content but also with many additional functions such as multiple navigations and fantasy effects.
These elements have to be removed in mobile content to allow easier browsing and to improve
‧
devices. For example, it is better to fit more content on the screen and eliminate the manipulation of horizontal scrolling. Also, developers have to fulfill the requirement above without destroying the original layout and introducing modes. Minimap adjusts the width of text and the rest of the elements to fit the screen so that users do not need to do much horizontal scrolling. In the case of occupying too much space, Minimap scales down the non-textual page elements such as images and scales up the size of textual elements by using the algorithm. All of this means that it can fit more content in the viewport.Minimap preserves the format of large data tables because tabular information such as schedules, stock prices, and time tables, is relevant for mobile use. It also provides a page overview to help users navigate the page. The page overview is a mini map of the whole page, and it is visible while users scroll down the page.
2.2 Dependency graph
A dependency graph is a directed graph representing dependency relations of objects and a dependency graph consist edges and nodes. The edges connect different nodes with directions.
The system can trace how the value of variable be modified in each node. Ottenstein (1984) suggested that dependency graph is a suitable form for the internal program representation because it allows programs to be sliced in linear time for debugging and optimizing Susan et al.(1982) introduced the tool gprof which display textual decompositions of the program structure in a convenient and informative way. The gprof profiler counts the execution time in
‧
the implementation of abstractions and it can help users to maintain and optimize the large, structured and hierarchical program. Lukoit et al.(2000) developed the visualization front-end TraceGraph which allows engineers to run the specific feature and view how the program execution varies. The program analyzer Stranger (Yu et al., 2010) parses the program codes and builds the dependency graph of program node. The analyzer exams all the node that suspicious variable pass through and finds the vulnerable node. Dependency graphs play the important roles in program analysis because it helps users easily understand the structure of the program.
RIPPLES (Chen and Rajich, 2001) helps users modify the source codes of legacy program without documentations by visualizing the dependency graphs. Grove et al. (1997) introduced the model which unified more algorithms to construct the call graphs of large and complicate programs. We also try to construct the dependency graphs in the front end applications so that users can know more about the vulnerabilities and have some idea about solving the problem.
2.3 Program Visualization
Visualization can help improve the comprehension of abstract program logics.
Gammatella (Orso et al., 2004) used the analogy of a traffic light to convey the concepts of danger, caution, and safety with the colors red, yellow, and green. Red represents the maximum value, and green represents the minimum value. The way that colors are assigned to status depends on the view of the targeting dimension. In Patcher, we also use colors to in indicate vulnerable files and deliver information on the risks of applications.
Wapiti (Surribas, 2013) is a scanner for auditing the security of web applications and it performs black-box examinations which scan webpages without studying the source code. It doesn’t provide the graphical interface and users have to manipulate through the command line interface. After auditing, the system generates the complete report with HTML format include
‧
medium, low) by the risk and highlighted by different colors. The report also contains a column chart for displaying the comparative of the vulnerabilities found. It also provides the attack detail of the examination with the risk level, the url, the attack string and the category of vulnerability.Netsparker (Mavituna Security, 2013) is a web application security scanner which can crawl, attack and identify and identify vulnerabilities in various types of web applications. It also performs black box examination by scanning each web page and the issue will be listed in a group when Netsparker detects it. Users can also check the analysis information through the scan summary dashboard.
Bohnet and Döllner (2006) developed the a technique that provides for the extraction of system architectures and dependencies between code components. The model includes the class-level model and the architectural-class-level model, and users can choose a scenario (a sequence of interactions between users and the system) that triggers specific executions. The visual layout separates nodes by the components such as functions and directories, and it also provides the capability to quickly access source codes by synchronizing the textual-source-code view with its graph-exploration view. If users click the function shape or call relation, the corresponding source code will be loaded into the textual source code view area, with the selected code line highlighted. Alternatively, the corresponding shape in the graph-exploration view will be highlighted when the source code line is selected. Later, we will show the capabilities of the cover program codes (level 0), data flows (level 1), dependency graphs (level 2), and architectural-level views (level 4), as specified in Table 1.
Some recent products focus on how to present contents on mobile devices.
SmartFoxServer (2013) is a multi-platform technology to integrate the Web server with mobile
‧
technology (Adobe Flash, Unity, iOS, Android, HTML5), enabling developers to build a multi-user platform. Ahmadi and Kong (2012) introduced an adaptive layout on the mobile screen based on advanced visual analysis and structural analysis that provides users with a tool to customize the screen layout on their mobile devices.
Our implementation for visualization is on Unity, which is a game engine and Integrated Device Electronics (IDE) cross-platform that not only supports PC, Mac, Xbox 360, and Web servers but also mobile operation systems such as iOS and Android. The graphic engine of Unity can be incorporated with Direct3D (Windows), OpenGL (Mac, Windows), OpenGL ES (iOS, Android), and proprietary APIs (e.g., Wii). Using Unity, our visualization tool can be deployed to multiple platforms, as evidenced by a remark from a Unity official: “author once, deploy everywhere.” Unity also supports integration with 3Ds Max, Maya, Softimage, Blender, Cinema 4D, Photoshop, and Adobe Fireworks. Changes that are made to the listed assets can be automatically updated in the Unity environment.
2.4 String Analysis and Vulnerability Detection
Due to its importance in security, string analysis has been widely studied. One influential approach has been grammar-based string analysis that statically computes an over-approximation of the values of string expressions in Java programs (Christensen et al., 2003), which has also been used to check for various types of errors in Web applications (Gould et al., 2004; Minamide 2005; Wassermann and Su, 2007 and 2008).
In addition, there are several recently developed string-analysis tools that use symbolic string analysis based on digital facility access (DFA) encodings (Shannon et al., 2007; Fu et al., 2007; Yu et al., 2008). Some of them are based on symbolic execution and use a DFA representation to model and verify the string manipulation operations in Java programs (Shannon
‧
et al., 2007; Fu et al., 2007). HAMPI (Kiezun et al. 2009) is a bounded-string constraint solver. It outputs a string that satisfies all the constraints or reports that the constraints are unsatisfiable.
Note that this type of bounded analysis cannot be used for sound string analysis, whereas the string-analysis techniques that we adopted in this paper are sound. Yu et al. (2008, 2010) have used single-track, DFA–based, symbolic-reachability analysis to verify the correctness of string sanitization operations in hypertext preprocessor (PHP) programs. Their preliminary results on generating (non-relational) vulnerability signatures using single-track DFA were reported in a short paper (Yu et al., 2009).
All of the above results use single-track DFA and encode the reachable configurations of each string variable separately—i.e., they use a non-relational string analysis. Yu et al. (2010) reported the results on foundations of string analysis using multi-track automata, which read tuples of characters as input instead of only single characters. Each string variable corresponds to a particular track (i.e., a particular position in the tuple), thereby allowing a relational analysis.
As demonstrated in Yu et al. (2010), a relational analysis enables verification of properties that cannot be verified with the earlier approaches. However, relational string analysis can generate automata that are exponentially larger than the automata generated during non-relational string analysis. To tackle this problem, we also incorporated the abstraction techniques with the tool, including alphabet abstractions and relational abstractions (Yu et al., 2011), which enabled us to improve the performance of the relational string analysis by adjusting its precision. The earlier results on relational string analysis presented in (Yu et al., 2010) do not use any abstraction techniques.
It is critical that vulnerabilities are not only discovered quickly but also repaired quickly. There has been previous work on automatically generating filters for blocking bad input (e.g., Costa et
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
al., 2007). This work focuses on buffer-overflow vulnerabilities that are different from the string vulnerabilities we investigate here. In Costa et al. (2007), the generation of filters is done starting with an existing exploit, whereas we plan to start with an attack pattern instead. Yu et al. (2009), used single-track automata to generate the vulnerability signatures of the detected vulnerabilities in the Web applications. In addition to generating vulnerability signatures, Yu et al. (2009) used the vulnerability signatures to generate effective sanitization statements, and by applying their techniques we were able to prove the absence of vulnerabilities in the applications that were patched with these statements. On the other hand, single-track automata are limited to model relations among variables. As shown in Yu et al. (2009), this limitation makes the analysis generate rather coarse vulnerability signatures—e.g., Σ* (any arbitrary string) for a vulnerability that can be exploited from multiple inputs. To tackle this problem, Yu et al. (2010) proposed a new approach to applying relational string analysis. They were able to generate more precise vulnerability signatures by catching the relations among inputs (Yu et al., 2011).
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
CHAPTER 3 “PATCHER”: THE WEB SERVICE
We propose Patcher to patch Web application vulnerabilities online so that users can upload PHP codes and view the results in different ways with different devices. We build the Web service as the middleware. The file user upload will be sent to the Web service, which will send it to Patcher in the back end after parsing it. Patcher will then analyze the source code and store the report in its database.
The front end’s applications communicate with the Web service to get the requested data, then the Web service retrieves the analysis results from the database and returns
them in the XML format.
The analysis process of Patcher is shown in Fig. 1. Users first upload the file they want to check, then the system performs taint analysis to identify tainted sinks, which are sensitive
Figure 1.The analysis components of Patcher.
‧
analysis. For each tainted sink, the system generates its conditional-dependency graph accordingly and passes the conditional-dependency graph to our string analyzer for further inspection. Then the system performs forward-path, sensitive-string analysis on the conditional-dependency graph using automata to calculate all possible values of each sink during execution.If it includes an attack string, we report the sink as a vulnerability, and for each vulnerability we subject all reachable attack strings (characterized as automatons) to vulnerability signature analysis. At the next step, the system uses both forward and backward analysis with single-track and multi-track automata to generate all potential malicious inputs. Based on these vulnerability signatures, we generated effective patches for inputs that ensure the removal of all reachable attack strings on sinks. Finally we stored the report that summarizes the analysis and performance in the database.
3.1 Web Service
The Web service plays the role of the middleware and helps the front-end application to communicate with the back-end server, then the Web service receives the data from the client side and sends it to Patcher for analyzing. After analyzing the data, Patcher generates the analysis results, including the lists of vulnerabilities and patch codes for vulnerabilities, and stores them in the database. When the front-end application requests the Web service for analysis results, the Web service retrieves the analysis results by the query string, and the front-end applications do visualization based on the analysis results they receive.
‧
Figure 2.The architecture of Web service.
The architecture of Patcher, shown in Fig. 2, consists of the front-end Web site and the back end that uses the Stranger tool (Yu et al., 2010, 2011). The service and the system were developed using Java, Java Servlet, Python, HTML, and C, deployed under the environment of Ubuntu 10.04. We used Eclipse as our IDE.
Several services are provided by the back-end server, including member management (register, login, logout, authority management), PHP file upload (single file, source code, applications), vulnerabilities analysis, patch code offering, and analysis history.
To improve the usability for the client side, the server side provides two formats of results analysis. The client side receives the analysis results, then determines by the header if it is a single file or an application, and the data can be displayed in different platforms such as Websites, mobile apps, or desktop applications using different display formats.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Users have to login by their identity so that they can use the service (see Fig. 3), and they have to sign up on the registration page (see Fig. 4) if they do not have an account. They can then upload a file through the Website (see Fig. 5), and the file uploaded can be source code, a PHP file, or a compressed file. After uploading the file, users will be shown a list of all the files they have uploaded (see Fig. 6). The list also provides information about the time spent on analysis and the analysis status of each file. If the user clicks one of the applications in the list, the page will be navigated to another page that contains a list of files in the selected application (see Fig.
7). The user can get a brief preview of each file by checking the vulnerabilities and can then decide whether to check the source code or not. Also, there is a report summary of the application on the top of the page.
Then the user can choose a file in detail by clicking the name label, which displays a summary of the selected file and the vulnerability list (see Fig. 8). If users click one of the vulnerabilities, the text area of the source code will scroll down to the position where the vulnerability is located, and a window will pop up providing the detailed information about the vulnerability and the patch code, so that users can revise the code directly.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Figure 3. The login page of the Website.
Figure 4 The registration page.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Figure 6. The list of uploaded applications.
Figure 5. The page for uploading files.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Figure 8. The vulnerable file list of a target application.
Figure 7. Users can find the vulnerability by highlighted codes.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
Figure 7. The patch code will be automatically attached once the patch label is clicked.
‧ 國
立 政 治 大 學
‧
N a
tio na
l C h engchi U ni ve rs it y
CHAPTER 4 VISUALIZATION
There are many functional components and much analysis data available in our system.
Normally, if users want to know get a result that is useful and easy to understand, they have to do several things manually, such as find the line number of the vulnerability in the source code and check the vulnerable files one by one. It is inefficient and can make users frustrated. We designed a set of front-end user-interface features that help users to access the information easily.
Normally, if users want to know get a result that is useful and easy to understand, they have to do several things manually, such as find the line number of the vulnerability in the source code and check the vulnerable files one by one. It is inefficient and can make users frustrated. We designed a set of front-end user-interface features that help users to access the information easily.