Open Access. Powered by Scholars. Published by Universities.®
Articles 1 - 2 of 2
Full-Text Articles in Engineering
Ufuzzer: Lightweight Detection Of Php-Based Unrestricted File Upload Vulnerabilities Via Static-Fuzzing Co-Analysis, Jin Huang, Junjie Zhang, Jialun Liu, Chuang Li
Ufuzzer: Lightweight Detection Of Php-Based Unrestricted File Upload Vulnerabilities Via Static-Fuzzing Co-Analysis, Jin Huang, Junjie Zhang, Jialun Liu, Chuang Li
Computer Science and Engineering Faculty Publications
Unrestricted file upload vulnerabilities enable attackers to upload malicious scripts to a web server for later execution. We have built a system, namely UFuzzer, to effectively and automatically detect such vulnerabilities in PHP-based server-side web programs. Different from existing detection methods that use either static program analysis or fuzzing, UFuzzer integrates both (i.e., static-fuzzing co-analysis). Specifically, it leverages static program analysis to generate executable code templates that compactly and effectively summarize the vulnerability-relevant semantics of a server-side web application. UFuzzer then “fuzzes” these templates in a local, native PHP runtime environment for vulnerability detection. Compared to static-analysis-based methods, UFuzzer preserves …
Botsniffer: Detecting Botnet Command And Control Channels In Network Traffic, Guofei Gu, Junjie Zhang, Wenke Lee
Botsniffer: Detecting Botnet Command And Control Channels In Network Traffic, Guofei Gu, Junjie Zhang, Wenke Lee
Computer Science and Engineering Faculty Publications
Botnets are now recognized as one of the most serious security threats. In contrast to previous malware, botnets have the characteristic of a command and control (C&C) channel. Botnets also often use existing common protocols, e.g., IRC, HTTP, and in protocol-conforming manners. This makes the detection of botnet C&C a challenging problem. In this paper, we propose an approach that uses network-based anomaly detection to identify botnet C&C channels in a local area network without any prior knowledge of signatures or C&C server addresses. This detection approach can identify both the C&C servers and infected hosts in the network. Our …