检索结果-内蒙古大学图书馆

input validation vulnerabilities in Web Applications: Systematic Review, Classification, and Analysis of the Current State-of-the-Art

引用

IEEE ACCESS 2023年 11卷 40128-40161页

作者： Faisal Fadlalla, Faris Elshoush, Huwaida T. Univ Khartoum Fac Math Sci & Informat Dept Comp Sci Khartoum 11115 Sudan

In recent years, huge increase in attacks and data breaches is noticed. Most of the attacks are performed and focused on the vulnerabilities related to web applications. Hence, nowadays the mitigation of application vulnerabilities is an ignited research area. Thus, due to the potential high severity impacts of web application, many different approaches have been proposed in the past decades to mitigate the damages of application vulnerabilities. Static and dynamic analysis are the two main techniques used. In this paper, a new classification for web application input validation vulnerabilities is proffered. In addition, various techniques/tools that are used to detect them are analyzed and evaluated to apprehend their strengths and weaknesses. Thus, this paper provides both technical as well as literature countermeasures to input validation vulnerabilities. Moreover, various statistical distributions of the reviewed techniques were manifested and scrutinize in different aspects to reveal the perception of the prevailing techniques and the gaps in the literature. In addition, the most widespread metrics are also propounded.

关键词： Source coding Security Databases Static analysis Codes Systematics Cross-site scripting Web security static analysis dynamic analysis input validation vulnerabilities source code review

来源：评论

学校读者我要写书评

暂无评论

Estimating software robustness in relation to input validation vulnerabilities using Bayesian networks

引用

SOFTWARE QUALITY JOURNAL 2018年第2期26卷 455-489页

作者： Ufuktepe, Ekincan Tuglular, Tugkan Izmir Inst Technol Dept Comp Engn Izmir Turkey

Estimating the robustness of software in the presence of invalid inputs has long been a challenging task owing to the fact that developers usually fail to take the necessary action to validate inputs during the design and implementation of software. We propose a method for estimating the robustness of software in relation to input validation vulnerabilities using Bayesian networks. The proposed method runs on all program functions and/or methods. It calculates a robustness value using information on the existence of input validation code in the functions and utilizing common weakness scores of known input validation vulnerabilities. In the case study, ten well-known software libraries implemented in the JavaScript language, which are chosen because of their increasing popularity among software developers, are evaluated. Using our method, software development teams can track changes made to software to deal with invalid inputs.

关键词： Robustness input validation vulnerabilities Bayesian networks

来源：评论

学校读者我要写书评

暂无评论

Predicting input validation vulnerabilities based on minimal SSA features and machine learning

引用

JOURNAL OF KING SAUD UNIVERSITY-COMPUTER AND INFORMATION SCIENCES 2022年第10期34卷 9311-9331页

作者： Marashdih, Abdalla Wasef Zaaba, Zarul Fitri Suwais, Khaled Univ Sains Malaysia Sch Comp Sci George Town 11800 Malaysia Arab Open Univ Fac Comp Studies Riyadh Saudi Arabia

Structured Query Language injection (SQLi) and Cross-Site Scripting (XSS) are the most renowned kinds of input validation vulnerabilities. Of late, vulnerability prediction models based on machine learning have been gaining acceptance in the domain of Web security. Such models offer an easy and effective way of dealing with web application security concerns. However, most of them, in particular, rely on complex graphs generated from source code or regex patterns based on expert knowledge. This paper proposed a method for extracting features from source code and predicting input validation vulnerabilities using machine learning algorithms. The proposed method can extract all features related to the flow of vulnerabilities among the programs and remove the features that are irrelevant to the vulnerability flow. In addition, each vulnerability's context has been assigned, providing additional data for our model to use in learning about the vulnerability context. Compared to other related methods, the feature extraction method proposed in this paper has been found to have high reusability and better performance. The best model related to the LSTM classifier had a 98.1% recall rate, a 97.9% precision, an accuracy of 98.67%, and a 99.03% area under the curve (AUC) in the test dataset.

关键词： input validation vulnerabilities XSS SQLi Minimal SSA Features extraction Machine learning

来源：评论

学校读者我要写书评

暂无评论

Detecting and Removing Web Application vulnerabilities with Static Analysis and Data Mining

引用

IEEE TRANSACTIONS ON RELIABILITY 2016年第1期65卷 54-69页

作者： Medeiros, Iberia Neves, Nuno Correia, Miguel Univ Lisbon Fac Ciencias LaSIGE P-1699 Lisbon Portugal Univ Lisbon Inst Super Tecn INESC ID P-1699 Lisbon Portugal Univ Lisbon Inst Super Tecn P-1699 Lisbon Portugal INESC ID P-1699 Lisbon Portugal

6Although a large research effort on web application security has been going on for more than a decade, the security of web applications continues to be a challenging problem. An important part of that problem derives from vulnerable source code, often written in unsafe languages like PHP. Source code static analysis tools are a solution to find vulnerabilities, but they tend to generate false positives, and require considerable effort for programmers to manually fix the code. We explore the use of a combination of methods to discover vulnerabilities in source code with fewer false positives. We combine taint analysis, which finds candidate vulnerabilities, with data mining, to predict the existence of false positives. This approach brings together two approaches that are apparently orthogonal: humans coding the knowledge about vulnerabilities (for taint analysis), joined with the seemingly orthogonal approach of automatically obtaining that knowledge (with machine learning, for data mining). Given this enhanced form of detection, we propose doing automatic code correction by inserting fixes in the source code. Our approach was implemented in the WAP tool, and an experimental evaluation was performed with a large set of PHP applications. Our tool found 388 vulnerabilities in 1.4 million lines of code. Its accuracy and precision were approximately 5% better than PhpMinerII's and 45% better than Pixy's.

关键词： Automatic protection data mining false positives input validation vulnerabilities software security source code static analysis web applications

来源：评论

学校读者我要写书评

暂无评论

Automatic Detection and Correction of Web Application vulnerabilities using Data Mining to Predict False Positives 14

Automatic Detection and Correction of Web Application Vulner...

引用

23rd International Conference on World Wide Web (WWW)

作者： Medeiros, Iberia Neves, Nuno F. Correia, Miguel Univ Lisbon Fac Sci LaSIGE Lisbon Portugal Univ Lisbon Inst Super Tecn INESC ID Lisbon Portugal

ISBN: (纸本)9781450327442

Web application security is an important problem in today's internet. A major cause of this status is that many programmers do not have adequate knowledge about secure coding, so they leave applications with vulnerabilities. An approach to solve this problem is to use source code static analysis to find these bugs, but these tools are known to report many false positives that make hard the task of correcting the application. This paper explores the use of a hybrid of methods to detect vulnerabilities with less false positives. After an initial step that uses taint analysis to flag candidate vulnerabilities, our approach uses data mining to predict the existence of false positives. This approach reaches a trade-off between two apparently opposite approaches: humans coding the knowledge about vulnerabilities (for taint analysis) versus automatically obtaining that knowledge (with machine learning, for data mining). Given this more precise form of detection, we do automatic code correction by inserting fixes in the source code. The approach was implemented in the WAP tool (1) and an experimental evaluation was performed with a large set of open source PHP applications.

关键词： Web applications security input validation vulnerabilities false positives source code analysis automatic protection software security data mining

来源：评论

学校读者我要写书评

暂无评论

IMPROVING VULNERABILITY DETECTION OF WAP

IMPROVING VULNERABILITY DETECTION OF WAP

引用

作者： Miguel Amorim Fale Universidade de Lisboa

学位级别：硕士

For over two decades, the web has been evolving from a simple set of hypermedia documents to a complex ecosystem of web applications that are supported by various frameworks. This paradigm shift has been promoting a series of practices that lead to an increasing number of vulnerabilities, which can compromise the security of web appli- cations. One of the main contributing factors lies in vulnerable source code, written in unsafe languages such as PHP. In order to mitigate the problem, a large research effort on web application security has occurred over the past years. Source code static analysis tools perform the task of finding program vulnerabilities in an automated fashion. These tools offer superior code coverage, easier integration into the application development cycle, and do not require the actual code to be executed. They instead perform source code analysis, looking for poten- tial bugs while inspecting the program code. However, the analysis performed by these tools depends on their knowledge of the classes of vulnerabilities and the implementation of analysis techniques, such as taint analysis. This means that, on one hand, the tools only search for vulnerabilities in the source code that they hold knowledge of, being unable to find other kinds of problems. On the other hand, the tools may generate false positives and false negatives, due to the limitations and incompleteness of implemented analysis techniques. One of such tools is the Web Application Protection (WAP). The main objective of this dissertation is to identify problems with WAP and improve its vulnerability detec- tion capabilities, when processing open source PHP code. Four static analysis tools - WAP, Pixy, phpSAFE and RIPS - are evaluated against a set of WordPress plugins that are known to be vulnerable, in order to collect examples of incorrect processing of the tools which lead, for instance, to false negatives. Additionally, we define and evaluate several use cases for a common foun

关键词： source code static analysis input validation vulnerabilities circular dependencies web application security software security

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：