Projects per year
Abstract
The NODE.JS runtime, in combination with Node Package Manager (NPM), is a popular ecosystem for building server-side web applications. Both JavaScript's flexible and dynamic character and the vast amount of NPM libraries available can speed up the development of web applications. However, JavaScript and NODE.JS lack security mechanisms and abstractions. Despite the numerous language-based approaches proposed to protect JavaScript applications, no work supports application- level and business-level security properties. This means that in order to achieve both application-level and business-level security, developers are forced to rely on multiple different, unintegrated and incompatible tools and mechanisms. In this paper, we present BRIGADIER, an interactive security testing framework for NODE.JS applications that enables the specification of both application-level and business-level security policies. BRIGADIER provides developers with a Datalog-based policy specification language that features close interoperability with running JavaScript programs under test. Input JavaScript programs are instrumented to emit relevant application events sent to a Datalog engine resulting from the compilation of the policies. We exhibit BRIGADIER's expressiveness by implementing three case studies from the literature. We also assess BRIGADIER's performance overhead on server-side applications. In our benchmarks, we observed a slowdown factor ranging from ~1.2x to ~3x, which is acceptable for a testing scenario.
Original language | English |
---|---|
Title of host publication | 2023 IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) |
Place of Publication | Taipa, Macau |
Publisher | IEEE |
Pages | 509-521 |
Number of pages | 12 |
ISBN (Electronic) | 978-1-6654-5278-6 |
ISBN (Print) | 978-1-6654-5279-3 |
Publication status | Published - 21 Mar 2023 |
Event | 30th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2023) - 28th Floor, Hotel Okura Macau, Macau SAR, China Duration: 21 Mar 2023 → 24 Mar 2023 Conference number: 30 https://saner2023.must.edu.mo/index |
Conference
Conference | 30th IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER 2023) |
---|---|
Abbreviated title | SANER'23 |
Country | China |
City | Macau SAR |
Period | 21/03/23 → 24/03/23 |
Internet address |
Projects
- 1 Active
-
VLAAI2: Subsidie Onderzoeksprogramma "Cybersecurity Initiative Flanders"
De Meuter, W., Devriese, D., Gonzalez Boix, E. & De Roover, C.
1/09/19 → 31/12/23
Project: Applied