Home A Semantic Approximation Technique for Automated Detection of Illicit Information Flows in Web-Based Systems

Publications

A Semantic Approximation Technique for Automated Detection of Illicit Information Flows in Web-Based Systems

Year : 2026

Publisher : Institute of Electrical and Electronics Engineers Inc.

Source Title : IEEE Access

Document Type :

Abstract

Security in software systems ultimately seeks to safeguard the confidentiality, integrity, and availability of information. Of these, ensuring confidentiality is extremely difficult as sensitive information can leak due to unauthorized information flows through program logic. These flows typically emerge when confidential values indirectly dictate public variables, enabling an attacker to extract secret information from observable behavior. Traditional controls, such as access control and encryption, protect systems against outside attacks but do not catch these inside propagation-based leaks. Current information flow analysis techniques, including dependency graph-based, have tried to solve this problem; however, they tend to be limited to syntactic analysis, resulting in inaccurate results and high false positives. In this paper, we introduce a security-focused framework that enhances database-driven program confidentiality verification through a dependency graph-based method. The system works in the following steps: (1) the program is converted to an extended dependency graph representation, (2) the syntactic graph is enriched with a semantics-based method based on Abstract Interpretation, (3) all potential information flow paths are discovered from the enriched graph, and (4) each of these paths is examined to identify illegitimate or confidentiality-violating flows. The semantics-based approach uses interval (non-relational) and polyhedral (relational) abstract domains to trade off scalability against accuracy, while sensitivity levels are computed for variables and database fields to enable satisfiability-based verification. The resulting system guarantees sound over-approximation of all potential flows, minimizes false positives, and offers a solid mechanism for guaranteeing information flow security in applications based on data.