The framework of model-carrying code (MCC) provides an effective and practical solution for the security of execution of untrusted mobile code. Our work significantly improves the MCC approach by introducing the more precise extended pushdown automaton (EPDA) as the program behavior model and developing an advanced method for constructing EPDA through static analysis of Java source code. This paper shows the formal definition and abstract representation of our new EPDA model, and presents the context-sensitive analysis of inter-method control flow and data flow. These improvements raise the ability of static analysis so that it is more applicable to object-oriented languages. We also integratively deal with exceptions, polymorphism, classes, objects and other features of the object-oriented language. Index Terms—static analysis, model generation, extended push- down automaton, mobile code security, object-oriented, context- sensitive.
['Xudong Zheng', 'Jinglei Ren', 'Xiaojuan Zheng', 'Yonglong Wei', 'Chen Sun']
Static Analysis of Java Source Code to Generate Security-Relevant Behavior Model Based on Extended Pushdown Automaton