Mining SQL injection and cross site scripting vulnerabilities using hybrid program analysis

• Main Authors: SHAR, Lwin Khin, TAN, Hee Beng Kuan, BRIAND, Lionel C.
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2013
• Subjects: Defect prediction; vulnerability; input validation and sanitization; static and dynamic analysis; empirical study; Software Engineering
• Online Access: https://ink.library.smu.edu.sg/sis_research/4781; https://ink.library.smu.edu.sg/context/sis_research/article/5784/viewcontent/Mining_SQL_Injection_and_Cross_Site_Scripting_Vulnerabilities_using_Hybrid_Program_Analysis_ICSE13.pdf
• Institution: Singapore Management University

In previous work, we proposed a set of static attributes that characterize input validation and input sanitization code patterns. We showed that some of the proposed static attributes are significant predictors of SQL injection and cross site scripting vulnerabilities. Static attributes have the adv...