Java Security Vulnerability Analysis Based on Java Access Permission Checking Tree

Abstract

Recently Java applets exploiting Java Security Manager's vulnerability have become serious threats to Java system security. In this paper, we analyze various kinds of malicious Java applet code and classify them according to the path they take to avoid the blockage by Java Security Manager. The result of this classification is JAPCT (Java Access Permission Checking Tree). We believe JAPCT will greatly enhance our ability to understand Java security vulnerabilities in the past and to predict possible security problems in the future Java Virtual Machine.