<?xml version="1.0" encoding="utf-8"?>
<TEI xmlns="http://www.tei-c.org/ns/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:hal="http://hal.archives-ouvertes.fr/" xmlns:gml="http://www.opengis.net/gml/3.3/" xmlns:gmlce="http://www.opengis.net/gml/3.3/ce" version="1.1" xsi:schemaLocation="http://www.tei-c.org/ns/1.0 http://api.archives-ouvertes.fr/documents/aofr-sword.xsd">
  <teiHeader>
    <fileDesc>
      <titleStmt>
        <title>HAL TEI export of hal-01370372</title>
      </titleStmt>
      <publicationStmt>
        <distributor>CCSD</distributor>
        <availability status="restricted">
          <licence target="https://creativecommons.org/publicdomain/zero/1.0/">CC0 1.0 - Universal</licence>
        </availability>
        <date when="2026-05-21T05:57:18+02:00"/>
      </publicationStmt>
      <sourceDesc>
        <p part="N">HAL API Platform</p>
      </sourceDesc>
    </fileDesc>
  </teiHeader>
  <text>
    <body>
      <listBibl>
        <biblFull>
          <titleStmt>
            <title xml:lang="en">Ghostrail: Ad Hoc Control-Flow Integrity for Web Applications</title>
            <author role="aut">
              <persName>
                <forename type="first">Bastian</forename>
                <surname>Braun</surname>
              </persName>
              <idno type="halauthorid">1061214-0</idno>
              <affiliation ref="#struct-98761"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Caspar</forename>
                <surname>Gries</surname>
              </persName>
              <idno type="halauthorid">1061239-0</idno>
              <affiliation ref="#struct-98761"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Benedikt</forename>
                <surname>Petschkuhn</surname>
              </persName>
              <idno type="halauthorid">1061240-0</idno>
              <affiliation ref="#struct-98761"/>
            </author>
            <author role="aut">
              <persName>
                <forename type="first">Joachim</forename>
                <surname>Posegga</surname>
              </persName>
              <idno type="halauthorid">989691-0</idno>
              <affiliation ref="#struct-98761"/>
            </author>
            <editor role="depositor">
              <persName>
                <forename>Hal</forename>
                <surname>Ifip</surname>
              </persName>
              <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
              <email type="domain">inria.fr</email>
            </editor>
          </titleStmt>
          <editionStmt>
            <edition n="v1" type="current">
              <date type="whenSubmitted">2016-09-22 14:26:23</date>
              <date type="whenModified">2016-09-22 15:11:03</date>
              <date type="whenReleased">2016-09-22 15:11:03</date>
              <date type="whenProduced">2014-06-02</date>
              <date type="whenEndEmbargoed">2017-01-01</date>
              <ref type="file" target="https://inria.hal.science/hal-01370372v1/document">
                <date notBefore="2017-01-01"/>
              </ref>
              <ref type="file" subtype="author" n="1" target="https://inria.hal.science/hal-01370372v1/file/978-3-642-55415-5_22_Chapter.pdf" id="file-1370372-1451504">
                <date notBefore="2017-01-01"/>
              </ref>
              <ref type="externalLink" target="https://link.springer.com/content/pdf/10.1007%2F978-3-642-55415-5_22.pdf"/>
            </edition>
            <respStmt>
              <resp>contributor</resp>
              <name key="200187">
                <persName>
                  <forename>Hal</forename>
                  <surname>Ifip</surname>
                </persName>
                <email type="md5">2073ac78024b6e13f2714db96e9b1e63</email>
                <email type="domain">inria.fr</email>
              </name>
            </respStmt>
          </editionStmt>
          <publicationStmt>
            <distributor>CCSD</distributor>
            <idno type="halId">hal-01370372</idno>
            <idno type="halUri">https://inria.hal.science/hal-01370372</idno>
            <idno type="halBibtex">braun:hal-01370372</idno>
            <idno type="halRefHtml">&lt;i&gt;29th IFIP International Information Security Conference (SEC)&lt;/i&gt;, Jun 2014, Marrakech, Morocco. pp.264-277, &lt;a target="_blank" href="https://dx.doi.org/10.1007/978-3-642-55415-5_22"&gt;&amp;#x27E8;10.1007/978-3-642-55415-5_22&amp;#x27E9;&lt;/a&gt;</idno>
            <idno type="halRef">29th IFIP International Information Security Conference (SEC), Jun 2014, Marrakech, Morocco. pp.264-277, &amp;#x27E8;10.1007/978-3-642-55415-5_22&amp;#x27E9;</idno>
            <availability status="restricted">
              <licence target="https://creativecommons.org/licenses/by/4.0/">CC BY 4.0 - Attribution<ref corresp="#file-1370372-1451504"/></licence>
            </availability>
          </publicationStmt>
          <seriesStmt>
            <idno type="stamp" n="IFIP">IFIP - International Federation for Information Processing</idno>
            <idno type="stamp" n="IFIP-AICT" corresp="IFIP">IFIP Advances in Information and Communication Technology</idno>
            <idno type="stamp" n="IFIP-TC" corresp="IFIP">IFIP Technical Committees </idno>
            <idno type="stamp" n="IFIP-AICT-428" corresp="IFIP-AICT">ICT Systems Security and Privacy Protection (SEC 2014)</idno>
            <idno type="stamp" n="IFIP-TC11" corresp="IFIP-TC">IFIP TC11: Security and Privacy Protection in Information Processing Systems</idno>
            <idno type="stamp" n="IFIP-SEC" corresp="IFIP"> International Information Security Conference</idno>
          </seriesStmt>
          <notesStmt>
            <note type="commentary">Part 6: Information Flow Control</note>
            <note type="audience" n="2">International</note>
            <note type="invited" n="0">No</note>
            <note type="popular" n="0">No</note>
            <note type="peer" n="1">Yes</note>
            <note type="proceedings" n="1">Yes</note>
          </notesStmt>
          <sourceDesc>
            <biblStruct>
              <analytic>
                <title xml:lang="en">Ghostrail: Ad Hoc Control-Flow Integrity for Web Applications</title>
                <author role="aut">
                  <persName>
                    <forename type="first">Bastian</forename>
                    <surname>Braun</surname>
                  </persName>
                  <idno type="halauthorid">1061214-0</idno>
                  <affiliation ref="#struct-98761"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Caspar</forename>
                    <surname>Gries</surname>
                  </persName>
                  <idno type="halauthorid">1061239-0</idno>
                  <affiliation ref="#struct-98761"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Benedikt</forename>
                    <surname>Petschkuhn</surname>
                  </persName>
                  <idno type="halauthorid">1061240-0</idno>
                  <affiliation ref="#struct-98761"/>
                </author>
                <author role="aut">
                  <persName>
                    <forename type="first">Joachim</forename>
                    <surname>Posegga</surname>
                  </persName>
                  <idno type="halauthorid">989691-0</idno>
                  <affiliation ref="#struct-98761"/>
                </author>
              </analytic>
              <monogr>
                <title level="m">IFIP Advances in Information and Communication Technology</title>
                <meeting>
                  <title>29th IFIP International Information Security Conference (SEC)</title>
                  <date type="start">2014-06-02</date>
                  <date type="end">2014-06-04</date>
                  <settlement>Marrakech</settlement>
                  <country key="MA">Morocco</country>
                </meeting>
                <editor>Nora Cuppens-Boulahia</editor>
                <editor>Frédéric Cuppens</editor>
                <editor>Sushil Jajodia</editor>
                <editor>Anas Abou El Kalam</editor>
                <editor>Thierry Sans</editor>
                <imprint>
                  <publisher>Springer</publisher>
                  <biblScope unit="serie">ICT Systems Security and Privacy Protection</biblScope>
                  <biblScope unit="volume">AICT-428</biblScope>
                  <biblScope unit="pp">264-277</biblScope>
                  <date type="datePub">2014</date>
                </imprint>
              </monogr>
              <idno type="doi">10.1007/978-3-642-55415-5_22</idno>
            </biblStruct>
          </sourceDesc>
          <profileDesc>
            <langUsage>
              <language ident="en">English</language>
            </langUsage>
            <textClass>
              <classCode scheme="halDomain" n="info">Computer Science [cs]</classCode>
              <classCode scheme="halTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halOldTypology" n="COMM">Conference papers</classCode>
              <classCode scheme="halTreeTypology" n="COMM">Conference papers</classCode>
            </textClass>
            <abstract xml:lang="en">
              <p>Modern web applications frequently implement complex control flows, which require the users to perform actions in a given order. Users interact with a web application by sending HTTP requests with parameters and in response receive web pages with hyperlinks that indicate the expected next actions. If a web application takes for granted that the user sends only those expected requests and parameters, malicious users can exploit this assumption by crafting harming requests. We analyze recent attacks on web applications with respect to user-defined requests and identify their root cause in the missing enforcement of allowed next user requests. Based on this result, we provide our approach, named Ghostrail, a control-flow monitor that is applicable to legacy as well as newly developed web applications. It observes incoming requests and lets only those pass that were provided as next steps in the last web page. Ghostrail protects the web application against race condition exploits, the manipulation of HTTP parameters, unsolicited request sequences, and forceful browsing. We evaluate the approach and show that it neither needs a training phase nor a manual policy definition while it is suitable for a broad range of web technologies.</p>
            </abstract>
            <particDesc>
              <org type="consortium">TC 11</org>
            </particDesc>
          </profileDesc>
        </biblFull>
      </listBibl>
    </body>
    <back>
      <listOrg type="structures">
        <org type="institution" xml:id="struct-98761" status="VALID">
          <idno type="ROR">https://ror.org/05ydjnb78</idno>
          <orgName>University of Passau</orgName>
          <desc>
            <address>
              <addrLine>Universität Passau Innstraße 41 D-94032 Passau</addrLine>
              <country key="DE"/>
            </address>
            <ref type="url">http://www.uni-passau.de/index.php?id=6&amp;L=1</ref>
          </desc>
        </org>
      </listOrg>
    </back>
  </text>
</TEI>