论文标题
局部敏感的散列，用于有效的Web应用程序安全测试
Locality-Sensitive Hashing for Efficient Web Application Security Testing
论文作者
论文摘要
近年来，随着越来越多的内容和服务在线提供，Web应用程序安全已成为主要问题。识别安全漏洞的一种有用方法是黑框测试，该测试依赖于Web应用程序的自动爬行。但是，爬行丰富的互联网应用程序（RIA）是一项非常具有挑战性的任务。爬行者面临的关键障碍之一是状态相似性问题：如何确定两个客户端状态是否等效。由于当前方法并不能完全解决此问题，因此仍然不可能成功扫描许多现实世界中的RIA。我们提出了一种用于检测冗余内容以进行安全测试目的的新方法。该算法使用Minhash草图应用了局部敏感的哈希，以分析网页的文档对象模型（DOM）结构，并有效估计它们之间的相似性。我们的实验结果表明，这种方法可以成功扫描RIA，否则无法爬行。
Web application security has become a major concern in recent years, as more and more content and services are available online. A useful method for identifying security vulnerabilities is black-box testing, which relies on an automated crawling of web applications. However, crawling Rich Internet Applications (RIAs) is a very challenging task. One of the key obstacles crawlers face is the state similarity problem: how to determine if two client-side states are equivalent. As current methods do not completely solve this problem, a successful scan of many real-world RIAs is still not possible. We present a novel approach to detect redundant content for security testing purposes. The algorithm applies locality-sensitive hashing using MinHash sketches in order to analyze the Document Object Model (DOM) structure of web pages, and to efficiently estimate similarity between them. Our experimental results show that this approach allows a successful scan of RIAs that cannot be crawled otherwise.
