Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.
-
date post
19-Dec-2015 -
Category
Documents
-
view
219 -
download
1
Transcript of Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.
![Page 1: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/1.jpg)
Relational Constraint Driven Test Case Synthesis for Web Applications
Dr. Xiang Fu
Assistant ProfessorDepartment of Computer Science
Hofstra University
![Page 2: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/2.jpg)
Introduction Path Transducer Model Relational Constraint Call Sequence Synthesis Detecting Workflow Attack Related Work and Conclusion
Outline
![Page 3: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/3.jpg)
Web Application and Database
Web Server
Databases
![Page 4: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/4.jpg)
Traditionally, SQLUnit & DBUnit◦Manual Test Case Design
Reverse Inference of DB State◦ Given Query & Expected Result◦ Generate Initial DB Instance
Our Problem: Synthesis Problem◦ Given Database State◦ Synthesize Call Sequence of Servlets
Testing Web App & DB
![Page 5: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/5.jpg)
White-box Analysis (1) Interface Extraction Path Transducers (2) Coverage Goal Extraction (3) Call Sequence Generation Adaptation Discover Workflow Attacks
Our Proposal
![Page 6: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/6.jpg)
Servlet Path Transducers Relational Transducer that Models One
Execution Path◦ Path Condition◦ Side Effects to DB
Path Transducer Model
Servlet
![Page 7: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/7.jpg)
Relational Data Schema Input Domain Finite Set of Session Variables Boolean Combination of Terms
◦ Equality v’ = v + 1
◦ Satisfiability Check
Path Transducer Model
))(( SAT ''21 Ta
![Page 8: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/8.jpg)
Selection
Projection
Cross Product
Union
Difference
Relational Algebra Formula)(21
)(2
21
21
21
![Page 9: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/9.jpg)
Motivating ExampleSimpleScarf
ShowSessions.php
InsertSession.phpAddMember.php
GenOptions.php
Login.php
![Page 10: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/10.jpg)
Database Schema
Users
vchar uname
vchar pwd
Sessions
int sid
vchar sname
Members
int sid
vchar uname
![Page 11: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/11.jpg)
ShowSessions.php
![Page 12: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/12.jpg)
Check Valid Session Var #uname Select Session Info No Side Effects
Path Transducer of ShowSession
![Page 13: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/13.jpg)
User Specify New Session Name $SI
Update Relation Sessions
InsertSession.php
![Page 14: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/14.jpg)
Takes Two Parameters◦ $uA: User Name
◦ $sA: Session Name Add Membership Info
AddMember.php
![Page 15: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/15.jpg)
Add User: One of Many Functions Available Takes Two Parameters
◦ $uG: User name
◦ $pG: Password
Generaloptions.php
Encrypt Password
Password RulesEncoded Using String
Constraint
![Page 16: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/16.jpg)
Given Two Parameters◦ $uL: user name
◦ $pL: password When Success, Update Session Variable
◦ #u: Session Variable on user name
Login.php
![Page 17: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/17.jpg)
Key to Synthesis Khurshid’s Approach [ASE’08] Translate to Alloy
Solving Relational Constraint
![Page 18: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/18.jpg)
Pre/Post Images
Transition System Post Image
![Page 19: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/19.jpg)
Key Problem: Satisfiability Check
Join of Session and Membership
Select Session Name ‘s1’
Project to uname Find users in paper session ‘s1’ but not in ‘s2’
Goal: Find DB Instance Satisfies query
![Page 20: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/20.jpg)
Translation of Data Schema
![Page 21: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/21.jpg)
Translation Part II
![Page 22: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/22.jpg)
Experimental Results
Vars Clauses Trans_Time Solve_Time
4833 7876 829ms 78ms
![Page 23: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/23.jpg)
Call Sequence Synthesis
Coverage Goal: Line
# 45
Path Transducers
CALL SeqSynthesis Algorithm
List of HTTP
Requests
![Page 24: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/24.jpg)
(Η’,ϒ’)
Knowledge In Advance:◦ (1) Each Path Transducer – Transition System
(Relational Logic)◦ (2) Relations being Modified (add, drop, modify)◦ (3) Session Vars being Modified
Algorithm: Backtrack
Heuristic Algorithm
(Η,ϒ)
HTTP Reques
t
Current Constraint
ϒ’ = Pre(H’, ϒ)
Heuristic to pick to the next servlet: watch the difference between the relations in the current constraints and target constraints. “Insertion” has priority
![Page 25: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/25.jpg)
Example: Coverage Target
Coverage Goal
Target Constraint: True
Initial Constraint:
Path Transducer:
![Page 26: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/26.jpg)
Pre-Image ComputationTransition Post-Image
Standard Existential Quantification
Initial Constraint:
CompareM and #u modified! Next servlet: AddMember or Login
![Page 27: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/27.jpg)
Constraint in Last Step
1.07 seconds for generating the model by ALLOY
![Page 28: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/28.jpg)
Workflow Attack
EnterAddr
ChargeCC
GenReceipt PrintShipping
How to Detect Workflow Attack?
(1)Static Analysis for ALL URLS that could be generated by a servlet
(2)Modify the Backtrack algorithm for locating an “abnormal” link not in the ALL_URLs set
Database manipulation TAKEN CARE OF.
![Page 29: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/29.jpg)
Proposal of Several Interesting Directions◦ Extraction of Path Transducer Model◦ Solving Relational Constraints◦ Call Sequence Synthesis Algorithm◦ Extension for Detecting Workflow Attacks
Future Directions◦ Implementation …
Conclusion
![Page 30: Dr. Xiang Fu Assistant Professor Department of Computer Science Hofstra University.](https://reader035.fdocuments.in/reader035/viewer/2022062407/56649d2c5503460f94a026b7/html5/thumbnails/30.jpg)
Interface Extraction◦ [Halfond’FSE07], [Halfond’FSE’08]
Relational Transducer◦ [Abiteboul’JCSS00]
Query Aware Relational Constraint Solving◦ [Binnig’ICDE07, Khalek’ICSE08]
Session Based Testing of Web App◦ [Elbaum’TSE05, Sampath’ASE05, Sprenkle’FSE05]
Related Work