Biblio

The article proposes an enhanced behavior model using graphs of state transitions. The properties and advantages of the proposed model are discussed, UML-based Cooperative Interaction of Automata Objects (CIAO) language is described, attribute approach on its parsing mechanism is introduced. The proposed model for describing behavior is aimed at achieving higher reliability and productivity indicators when designing the secure architecture and implementing reactive and distributed systems in comparison with traditional methods. A side-by-side goal is to create a convenient publication language for describing parallel algorithms and distributed reactive systems. The offered model has advantages under certain conditions in comparison with other models of behavior description in the field of the description of asynchronous distributed reacting systems.

The best practice to prevent Cross Site Scripting (XSS) attacks is to apply encoders to sanitize untrusted data. To balance security and functionality, encoders should be applied to match the web page context, such as HTML body, JavaScript, and style sheets. A common programming error is the use of a wrong encoder to sanitize untrusted data, leaving the application vulnerable. We present a security unit testing approach to detect XSS vulnerabilities caused by improper encoding of untrusted data. Unit tests for the XSS vulnerability are automatically constructed out of each web page and then evaluated by a unit test execution framework. A grammar-based attack generator is used to automatically generate test inputs. We evaluate our approach on a large open source medical records application, demonstrating that we can detect many 0-day XSS vulnerabilities with very low false positives, and that the grammar-based attack generator has better test coverage than industry best practices.