检索结果-内蒙古大学图书馆

16th European Dependable Computing Conference (EDCC)

作者： Medeiros, Iberia Neves, Nuno Univ Lisbon Fac Ciencias LASIGE Lisbon Portugal

ISBN: (纸本)9781728189369

web application security has become paramount for the organisation's operation, and therefore, static analysis tools (SAT) for vulnerability detection have been widely researched in the last years. Nevertheless, SATs often generate errors (false positives & negatives), whose cause is recurrently associated with very diverse coding styles, i.e., similar functionality is implemented in distinct manners, and programming practices that create ambiguity, such as the reuse and share of variables. The paper presents an analysis of SAT's behaviour and results when they process various relevant web applications coded with different coding styles. Furthermore, it discusses if the SQL injection vulnerabilities detected by SATs as true positives are really exploitable. Our results demonstrate that SATs are built having in mind how to detect specific vulnerabilities, without considering such forms of programming. They call to action for a new generation of SATs that are highly malleable to be capable of processing the codes observed in the wild.

关键词： web application vulnerabilities static analysis tools coding styles SQLi exploitation software security

来源：评论

学校读者我要写书评

暂无评论

A Method for web application vulnerabilities Detection by Using Boyer-Moore String Matching Algorithm 3rd

A Method for Web Application Vulnerabilities Detection by Us...

引用

3rd Information Systems International Conference

作者： Saleh, Ain Zubaidah Mohd Rozali, Nur Amizah Buja, Alya Geogiana Jalil, Kamarularifin Abd. Ali, Fakariah Hani Mohd Rahman, Teh Faradilla Abdul Univ Teknol MARA Shah Alam 40000 Malaysia Univ Teknol MARA Merlimau 77300 Melaka Malaysia Univ Teknol MARA Kuala Selangor 42300 Selangor Malaysia

Internet have become a great medium of communication as it is free, supportive, entertaining and easily for reachable to millions of people today. The usage of Internet among people become higher day by day, thus also increase the number of web application. Nevertheless, most of the web application exists have some vulnerability as there are some irresponsible people known as hacker that able to interrupt the peace of it. Some of well-known web application vulnerabilities are SQL Injection, Buffer Overflow, Cross Site Scripting and Cross Site request Forgery. In order to overcome this vulnerabilities, it is important to detect first the problem before prevent it. At present, there are a lot of web application vulnerabilities scanner that have been proposed by researcher for detecting web application vulnerabilities such as Acunetix WVS by Acunetix, Netsparker by Mavituna Security, w3af by w3af. org and Firefuzzer. However, these scanners have some limitation such as higher false negative although some of it has no false positive. Therefore, this paper proposed a technique aim to solve these issues by developing a detection method for detect the web application vulnerabilities by using Boyer-Moore String Matching Algorithm. Numerous experiments have been conducted in order to evaluate the performance. The result shows that proposed method has performed well in terms of the ability to accurately detect vulnerabilities based on false negative and have no false positive with low processing time. (C) 2015 Published by Elsevier B. V.

关键词： web application vulnerabilities SQL Injection Buffer Overflow Cross-Site Scripting Cross-Site Request Forgery

来源：评论

学校读者我要写书评

暂无评论

A Method for web application vulnerabilities Detection by Using Boyer-Moore String Matching Algorithm

引用

Procedia Computer Science 2015年 72卷 112-121页

作者： Ain Zubaidah Mohd Saleh Nur Amizah Rozali Alya Geogiana Buja Kamarularifin Abd. Jalil Fakariah Hani Mohd Ali Teh Faradilla Abdul Rahman Universiti Teknologi MARA Shah Alam 40000 Selangor Universiti Teknologi MARA Kampus Jasin Merlimau 77300 Melaka Universiti Teknologi MARA Kampus Puncak Alam Kuala Selangor 42300 Selangor

Internet have become a great medium of communication as it is free, supportive, entertaining and easily for reachable to millions of people today. The usage of Internet among people become higher day by day, thus also increase the number of web application. Nevertheless, most of the web application exists have some vulnerability as there are some irresponsible people known as hacker that able to interrupt the peace of it. Some of well-known web application vulnerabilities are SQL Injection, Buffer Overflow, Cross Site Scripting and Cross Site request Forgery. In order to overcome this vulnerabilities, it is important to detect first the problem before prevent it. At present, there are a lot of web application vulnerabilities scanner that have been proposed by researcher for detecting web application vulnerabilities such as Acunetix WVS by Acunetix, Netsparker by Mavituna Security, w3af by *** and Firefuzzer. However, these scanners have some limitation such as higher false negative although some of it has no false positive. Therefore, this paper proposed a technique aim to solve these issues by developing a detection method for detect the web application vulnerabilities by using Boyer-Moore String Matching Algorithm. Numerous experiments have been conducted in order to evaluate the performance. The result shows that proposed method has performed well in terms of the ability to accurately detect vulnerabilities based on false negative and have no false positive with low processing time.

关键词： web application vulnerabilities SQL Injection Buffer Overflow Cross-Site Scripting Cross-Site Request Forgery

来源：评论

学校读者我要写书评

暂无评论

KAVE: A Knowledge-Based Multi-Agent System for web Vulnerability Detection

KAVE: A Knowledge-Based Multi-Agent System for Web Vulnerabi...

引用

IEEE International Conference on web Services (IEEE ICWS)

作者： Ramires, Rafael Respicio, Ana Medeiros, Iberia Univ Lisbon LASIGE DI Fac Ciencias Lisbon Portugal

ISBN: (纸本)9798350368567;9798350368550

The growing use of the web has led to a rise in cyber attacks exploiting software vulnerabilities, thereby causing significant damage to companies and individuals. Static analysis tools can assist programmers in identifying vulnerabilities within their code. However, these tools are prone to producing false positives and lack precision, which relegates them to a somewhat marginalised role in software development. This paper proposes a new and more effective static analysis approach for assessing and evaluating web applications against vulnerabilities by using a knowledge-based multi-agent system web vulnerability detector called KAVE. The multi-agent system performs static taint analysis over a specially designed multi-layer knowledge graph, whereas this graph aggregates diverse interconnected representations of the lexical and semantic features of the application's source code, their data and control flows, and function calls. Additionally, this graph integrates security properties associated with vulnerabilities. The evaluation results of KAVE and comparison with existing tools showed that KAVE employs an effective and efficient method to detect vulnerabilities in web applications, finding 235 vulnerabilities with a precision of 95.9% over 12 open-source PHP web applications.

关键词： web application vulnerabilities Static Analysis Multi-Layer Knowledge Graph Multi-Agent System Software Security

来源：评论

学校读者我要写书评

暂无评论

A Pilot Study on Secure Code Generation with ChatGPT forweb applications 24

A Pilot Study on Secure Code Generation with ChatGPT forWeb ...

引用

Annual ACM Southeast Conference (ACMSE)

作者： Jamdade, Mahesh Liu, Yi Univ Massachusetts Dartmouth Dartmouth MA 02747 USA

ISBN: (纸本)9798400702372

Conversational Large Language Models (LLMs), such as ChatGPT, have demonstrated their potent capabilities in natural language processing tasks. This paper presents a pilot study that uses ChatGPT for generating web application code with a specific emphasis on mitigating four prevalent web application vulnerability types: SQL Injection, Cross Site Scripting, Carriage Return Line Feed Injection, and Exposure of Sensitive Information. The paper uses a case study to illustrate how the vulnerabilities in the code are mitigated with the prompts and the subsequent refinements. The study's findings summarize the security concerns in the code generated by ChatGPT, and the paper proposes a prompt pattern designed to help mitigating the potential vulnerabilities.

关键词： Secure coding web application vulnerabilities generative AI ChatGPT

来源：评论

学校读者我要写书评

暂无评论

DANGEROUSNESS OF CLIENT-SIDE CODE EXECUTION WITH MICROSOFT OFFICE

引用

COMPUTING AND INFORMATICS 2024年第5期43卷 1219-1233页

作者： Dora, Jean Rosemond Hluchy, Ladislav Slovak Acad Sci Inst Informat Dubravska cesta 9 Bratislava 84507 Slovakia

Gaining unauthorized remote access to an environment is generally done either by exploiting a vulnerable service, or application that is internet-based;or by tricking a user into executing malicious codes. The former one is typically more simple since there is no need for any user interaction. The latter one, however, requires much more effort on the attackers' side since they must find a way to incite the victim into opening a malicious document and interacting with an HTML page in a web browser. In this paper, we will focus on the latter technique which falls into the social engineering category, as it will involve the use of a phishing attack. The reason for this selection is based on the fact that it is challenging to correct user behavior. Thus, it increases the attackers' chance of performing a successful attack, contrary to the former technique, where a simple patch, upgrade, or update can prevent the adversaries from being successful in their attacks. Since Microsoft Office is a very trusted and used software by many people (both in personal and commercial use), we will make use of its features to build our payloads and eventually to gain a remote code execution to a victim's system. Performing a successful phishing attack involves a lot of barriers that often need to be crossed such as the need for similarity, purchasing domains, the use of encoding, encryption, etc. Nowadays, companies frequently employ very aggressive antivirus software that will delete malicious files as soon as they land on their system. Therefore, bypassing the security protections will need to be taken into account, which will also be addressed in this paper.

关键词： weakness Microsoft Office macros information security cyber-threats website se-curity web application vulnerabilities Client-side attacks remote code execution phishing vulnerability

来源：评论

学校读者我要写书评

暂无评论

ASPIDA: An Observatory for Security and Privacy in the Greek e-Business Sector 25

ASPIDA: An Observatory for Security and Privacy in the Greek...

引用

25th Pan-Hellenic Conference on Informatics with International Participation (PCI)

作者： Vlachos, Vasileios Katevas, Gerasimos Katsidimas, Ioannis Kerimakis, Emmanouil Nikoletseas, Sotiris Panagiotou, Stefanos Spirakis, Paul Univ Thessaly Volos Greece Comp Technol Inst & Press Diophantus CTI Volos Greece Univ Patras Comp Engn & Informat Dept Patras Greece Univ Liverpool Liverpool Merseyside England

ISBN: (纸本)9781450395557

Modern e-business policy aims to better frame and steer progress and advancements towards a legal and security aware framework. However, a large percentage of cases neglects the adoption of good security practices, exposing customers to potential risks. In this work, we present a hybrid approach upon self-assessment, self-improvement and self-regulation motivation, offered by the observAtory for Security and PrIvacy DAta (ASPIDA) system. To address privacy and security weaknesses we monitor and analyze a set of security and privacy metrics and indicators. The evaluation of the aforementioned criteria drives an outcome in the form of a digital badge of good practices for the specific website. This digital badge is a recognition and can be used by the e-business owners as an attraction that frames the services and content they offer to the public.

关键词： cybersecurity web application vulnerabilities privacy e-business world wide web

来源：评论

学校读者我要写书评

暂无评论

Predicting Common web application vulnerabilities from Input Validation and Sanitization Code Patterns 12

Predicting Common Web Application Vulnerabilities from Input...

引用

27th IEEE/ACM International Conference on Automated Software Engineering (ASE)

作者： Shar, Lwin Khin Tan, Hee Beng Kuan Nanyang Technol Univ Sch Elect & Elect Engn Singapore 639798 Singapore

ISBN: (纸本)9781450312042

Software defect prediction studies have shown that defect predictors built from static code attributes are useful and effective. On the other hand, to mitigate the threats posed by common web application vulnerabilities, many vulnerability detection approaches have been proposed. However, finding alternative solutions to address these risks remains an important research problem. As web applications generally adopt input validation and sanitization routines to prevent web security risks, in this paper, we propose a set of static code attributes that represent the characteristics of these routines for predicting the two most common web application vulnerabilities-SQL injection and cross site scripting. In our experiments, vulnerability predictors built from the proposed attributes detected more than 80% of the vulnerabilities in the test subjects at low false alarm rates.

关键词： Defect prediction static code attributes web application vulnerabilities input validation and sanitization empirical study

来源：评论

学校读者我要写书评

暂无评论

A Survey on web application vulnerabilities and Countermeasures

A Survey on Web Application Vulnerabilities and Countermeasu...

引用

6th International Conference on Computer Sciences and Convergence Information Technology (ICCIT)

作者： Atashzar, Hasty Torkaman, Atefeh Bahrololum, Marjan Tadayon, Mohammad H. ICT Research Institute (ITRC) Iran

ISBN: (纸本)9788988678558

Security vulnerabilities continue to infect web applications, allowing attackers to access sensitive data and exploiting legitimate web sites as a hosting ground for malware. Consequently, researchers have focused on various approaches to detect and prevent critical classes of security vulnerabilities in web applications, including anomaly-based and misuse-based detection mechanisms, static and dynamic server-side and client-side web application security policy enforcement. This paper present a survey on web application security aspects includes critical vulnerabilities, hacking tools and also approaches to improve web application and websites security level.

关键词： web application Security web application vulnerabilities Fundamental and Mitigating Solution

来源：评论

学校读者我要写书评

暂无评论

ASPIDA: An Observatory for Security and Privacy in the Greek e-Business Sector 2021

ASPIDA: An Observatory for Security and Privacy in the Greek...

引用

25th Pan-Hellenic Conference on Informatics

作者： Vasileios Vlachos Gerasimos Katevas Ioannis Katsidimas Emmanouil Kerimakis Sotiris Nikoletseas Stefanos Panagiotou Paul Spirakis Department of Economics University of Thessaly Greece and Computer Technology Institute and Press Greece University of Patras Greece University of Patras Greece and Computer Technology Institute and Press Greece

ISBN: (纸本)9781450395557

关键词： privacy cybersecurity world wide web e-business web application vulnerabilities

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：