Academia.eduAcademia.edu

Outline

Title
Abstract
Figures
Introduction
Conclusion and Future Work
References
All Topics
Engineering

On the automation of vulnerabilities fixing for web application

Profile image of Novia AdmodisastroNovia Admodisastro

2014

Abstract

Testing Web applications for detection and fixing of vulnerabilities has become an indispensable task in web applications’ development process. This task often consumes a lot of time, efforts and other resources. The research community have devoted considerable amount of efforts to address this problem by proposing many techniques for automated vulnerabilities detection and fix generation for web application. Many of these techniques can reliably detect vulnerabilities and generate fix(es), which can be applied to the web application’s code, by the developer, for possible fixing of the vulnerabilities. Hence, the actual code modifications that fix the vulnerabilities is not automated and has to be carried out manually. To the best of our knowledge, none of the existing automated techniques is able to do this, and hence the actual fixing of the vulnerabilities is left for the human developer to handle. In this paper, we propose a novel framework for automatic vulnerabilities fixing f...

Figures (1)
Figure 1. Framework for automated vulnerabilities fixing
Figure 1. Framework for automated vulnerabilities fixing

Related papers

An Experimental Study on Detecting and Mitigating Vulnerabilities in Web Applications
Dr Venkadeshan Ramalingam

International journal of safety and security engineering, 2024

The increasing use of the internet has led to a growing number of security threats. Computers, smartphones, smartwatches, and other mobile devices associated with the internet face different threats and exploits. In those cases, different services are provided through web applications only. Those applications are vulnerable to hacking. There are over 1.9 billion websites today, and everything is connected to the network. According to the new national vulnerability database update, 10,683 weaknesses were found in web applications in the first quarter of 2023. The websites have the most significant details of the clients, like personal details, financial details, and so on. Checking all the web application weaknesses is not a silver bullet. So, vulnerability scanners play a significant role in web application security. Vulnerability analysis and penetration testing are two distinct vulnerability types of testing. These tests can help identify all the vulnerabilities in a web application, even those not detected by vulnerability scanners. While certain users access this vulnerability analysis data with just honest goals, like creating some security measures to avoid those vulnerabilities, some utilize it to recognize ways of destroying significant information and records of websites. As it is notable, the term penetration testing is also ethical hacking. The current paper aims to investigate penetration testing on web applications. The paper discusses the different types of penetration testing, the tools and techniques used, and the benefits of penetration testing. It also suggests the challenges of penetration testing and the steps that can be taken to mitigate these challenges.

View PDFchevron_right
SecureChange: An Automated Framework to Guide Programmers in Fixing Vulnerability
Sayem Imtiaz

2020

When developers fix a defect, they may change multiple files. The number of files changed for resolving the defect depends on how strongly the files are coupled with each other. In earlier works, researchers leveraged this coupling for better understanding and analyzing software as well as for guiding developers to quickly find all probable code areas to complete fixing a defect. In some studies, researchers generated association rules reflecting the coupling among files and built tools to automate the discovery of the related changes in the files. Such tools, however, do not consider the type of defects resolved earlier for generating the rules as a result of which many unrelated files may come up while changing a file in later releases for resolving a specific type of defect. Therefore, in our study, we consider only security defects or vulnerabilities to generate the rules and then automate the finding process of other related files while fixing a vulnerability. Our tool “SecureC...

View PDFchevron_right
Pixy: A static analysis tool for detecting web application vulnerabilities
Mohammed Hamada

Security and Privacy, 2006 …, 2006

The number and the importance of Web applications have increased rapidly over the last years. At the same time, the quantity and impact of security vulnerabilities in such applications have grown as well. Since manual code reviews are time-consuming, error-prone and costly, the need for automated solutions has become evident.

View PDFchevron_right
Investigation of Detection and Mitigation of Web Application Vulnerabilities
maya rathore

International journal of computer applications, 2022

Web applications are the backbone of technology in the global era of information. In this digital world connecting many commercial organizations that utilize the internet for financial transactions, education, and other activities. In recent days, web applications have been exploited by attackers frequently. Most web developers and website owners have limited awareness of the vulnerabilities in their websites,which are prone to web vulnerability attacks. Many researchers are working to detect and mitigate the vulnerability and provide differentmethods to resolve the various types of web vulnerabilities. However, these solutions are insufficient since they often have restrictions and areinefficient to prevent all vulnerabilities. This paper aims to reviewexisting detection and mitigation methodsfor web application vulnerabilities.This will helppractitioners to develop practices and solve issues related to web vulnerabilities.

View PDFchevron_right
Detection and Mitigation of Web Application Vulnerabilities Based on Security Testing
Namje Park

2012

Abstract The paper proposes a security testing technique to detect known vulnerabilities of web applications using both static and dynamic analysis. We also present a process to improve the security of web applications by mitigating many of the vulnerabilities revealed in the testing phase, and address a new method for detecting unknown vulnerabilities by applying dynamic black-box testing based on a fuzzing technique.

View PDFchevron_right
Using Vulnerability Injection to Improve Web Security
Francesca Matarese

Innovative Technologies for Dependable OTS-Based Critical Systems, 2013

This chapter presents a methodology to evaluate and benchmark web application vulnerability scanners using software fault injection techniques. The most common software faults are injected in the web application source code, which is then checked by the scanners. Using this procedure, we evaluated three leading commercial scanners, which are often regarded as an easy way to test the security of web applications, including critical vulnerabilities such as XSS and SQL Injection. Our idea consists of providing the scanners with the input they are supposed to handle, which is a web application with software faults and possible vulnerabilities originated by such faults. The results of the scanners are compared evaluating the efficiency in identifying the potential vulnerabilities created by the injected fault, their coverage of vulnerability detection and false positives. However, the results show that the coverage of these tools is low and the percentage of false positives is very high.

View PDFchevron_right
A hybrid analysis framework for detecting web application vulnerabilities
Mattia Monga

2009 ICSE Workshop on Software Engineering for Secure Systems, 2009

Increasingly, web applications handle sensitive data and interface with critical back-end components, but are often written by poorly experienced programmers with low security skills. The majority of vulnerabilities that affect web applications can be ascribed to the lack of proper validation of user's input, before it is used as argument of an output function. Several program analysis techniques were proposed to automatically spot these vulnerabilities. One particularly effective is dynamic taint analysis. Unfortunately, this approach introduces a significant run-time penalty.

View PDFchevron_right
Automatic Testing of Program Security Vulnerabilities
hossain shahriar

2009

Vulnerabilities in applications and their widespread exploitation through successful attacks are common these days. Testing applications for preventing vulnerabilities is an important step to address this issue. In recent years, a number of security testing approaches have been proposed. However, there is no comparative study of these work that might help security practitioners select an appropriate approach for their needs. Moreover, there is no comparison with respect to automation capabilities of these approaches. In this work, we identify seven criteria to analyze program security testing work. These are vulnerability coverage, source of test cases, test generation method, level of testing, granularity of test cases, testing automation, and target applications. We compare and contrast prominent security testing approaches available in the literature based on these criteria. In particular, we focus on work that address four most common but dangerous vulnerabilities namely buffer overflow, SQL injection, format string bug, and cross site scripting. Moreover, we investigate automation features available in these work across a security testing process. We believe that our findings will provide practical information for security practitioners in choosing the most appropriate tools.

View PDFchevron_right
An empirical study on combining diverse static analysis tools for web security vulnerabilities based on development scenarios
José Fonseca

Computing, 2018

Automated Static Analysis Tools (ASATs) are one of the best ways to search for vulnerabilities in applications, so they are a resource widely used by developers to improve their applications. However, it is well-known that the performance of such tools is limited, and their detection capabilities may not meet the requirements of the project regarding the criticality of the application. Diversity is an obvious direction to take to improve the true positives, as different tools usually report distinct vulnerabilities, however with the cost of also increasing the false positives, which may be unacceptable in some scenarios. In this paper, we study the problem of combining diverse ASATs to improve the overall detection of vulnerabilities in web applications, considering four development scenarios with different criticality goals and constraints.

View PDFchevron_right
Mapping software faults with web security vulnerabilities
Marco Antonio Borges Vieira

Proceedings of the International Conference on Dependable Systems and Networks, 2008

Web applications are typically developed with hard time constraints and are often deployed with critical software bugs, making them vulnerable to attacks. The classification and knowledge of the typical software bugs that lead to security vulnerabilities is of utmost importance. This paper presents a field study analyzing 655 security patches ofsix widely used web applications. Results are compared against other field studies on general software faults (i.e., faults not specifically related to security), showing that only a small subset of software fault types is related to security. Furthermore, the detailed analysis of the code of the patches has shown that web application vulnerabilities result from software bugs affecting a restricted collection of statements.

View PDFchevron_right

References (29)

  1. D. Watson and U. K. H. Project, "Web application attacks," Journal of Network Security, vol. 2007, iss. 10, Oct. 2007, pp. 10-14, doi:10.1016/S1353-4858(07)70094-6.
  2. D. Gollmann, "Securing web applications," Information Security Technical Report, ELSEVIER, vol. 13, no. 1, Jan. 2008, pp. 1-9, doi:10.1016/j.istr.2008.02.002.
  3. A. Garg and S. Singh, "A review on web application security vulnerabilities," International Journal of Advanced Research in Computer Science and Software Engineering, (IJARCSSE), vol. 3, no. 1, 2003, pp. 222-226.
  4. OWASP, "OWASP top 10 project," https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project , [retrieved: May 2014].
  5. CWE, "CWE-SANS top 25 most dangerous software errors," Common Weakness Enumeration, Http://cwe.mitre.org/ top25/. (http://cwe.mitre. Org/top25/), [retrieved: May 2014].
  6. J. M. Chen and C. L. Wu, "An automated vulnerability scanner for injection attack based on injection point," Proc. IEEE International Computer Symposium, IEEE Press, Tainan, Dec. 2010, pp. 113-118, doi:10.1109/COMPSYM.2010.5685537.
  7. L. Luo, "Software testing techniques," Class Report for 17-939A, Institute for Software Research International, Carnegie Mellon University, USA. (http://mcahelpline.com/tutorials/testing/testing.pdf).
  8. J. Irena, "Software testing methods and techniques," The IPSI BgD Transactions on Internet Research, 2008, internetjournals.net.
  9. A. Arcuri, "Evolutionary repair of faulty software," Journal of Applied Soft Computing, ELSEVIER, vol. 11, iss. 4, June. 2011, pp. 3494- 3514, doi:10.1016/j.asoc.2011.01.023.
  10. A. Arcuri, "On search based software evolution," Proc. IEEE 1st International Symposium on Search Based Software Engineering, IEEE Press, Windsor, May. 2009, pp. 39-42, doi:10.1109/SSBSE.2009.12.
  11. A. Arcuri, "On the automation of fixing software bugs," Proc. ACM 30th International Conference on Software Engineering, ACM, Leipzig, Germany, May. 2008, pp. 1003-1006, doi:10.1145/1370175.1370223.
  12. A. Abraham, "Evolutionary computation: from Genetic Algorithms to Genetic Programming," in Genetic Systems Programming: Theory and Experiences, Ecological Studies 185, N. Nedjah and A. Abraham, Springer, 2005, pp. 1-20.
  13. R. G. S. ASTHANA, "Evolutionary Algorithms and Neural Networks," in Soft Computing and Intelligent Systems: Theory and Applications, A volume in Academic Press Series in Engineering, N. K. Sinha, M. M. Gupta and L. A. Zadeh, ELSEVIER Inc, 2000, pp. 111-136.
  14. J. Bau, E. Bursztein, D. Gupta and J. Mitchell, "State of the art: automated black-box web application vulnerability testing," Proc. IEEE Symp. Security and Privacy (SP), IEEE Press, Oakland, CA, May. 2010, pp. 332-345, doi:10.1109/SP.2010.27.
  15. F. Dysart and M. Sherriff, "Automated fix generator for SQL injection attacks," Proc. IEEE 19th International Symposium on Software Reliability Engineering, (ISSRE), IEEE Press, Seattle, WA, Nov. 2008, pp. 311-312, doi:10.1109/ISSRE.2008.44.
  16. Z. Djuric, "A black-box testing tool for detecting SQL injection vulnerabilities," Proc. IEEE Second International Conference on Informatics and Applications, (ICIA), IEEE Press, Lodz, Sept. 2013, pp. 216-221, doi:10.1109/ICoIA.2013.6650259.
  17. B. Qu, B. Liang, S. Jiang and C. Ye, "Design of automatic vulnerability detection system for web application program," Proc. IEEE 4th International Conference on Software Engineering and Service Science, (ICSESS), IEEE Press, Beijing, May. 2013, pp. 89-92, doi:10.1109/ICSESS.2013.6615262.
  18. G. Wassermann and Z. Su, "Static detection of Cross-Site Scripting vulnerabilities," Proc. ACM/IEEE 30th International Conference on Software Engineering, (ICSE), ACM/IEEE, Leipzig, May. 2008, pp. 171-180, doi:10.1145/1368088.1368112.
  19. A. Smirnov and T. Chiueh, "Automatic patch generation for Buffer Overflow attacks," Proc. IEEE Third International Symposium on Information Assurance and Security, (IAS), IEEE Press, Manchester, Aug. 2007, pp. 165-170, doi:10.1109/IAS.2007.87.
  20. B. Eshete, A. Villafiorita, K. Weldemariam and M. Zulkernine, "Confeagle: Automated analysis of Configuration vulnerabilities in web applications," Proc. IEEE 7th International Conference on Software Security and Reliability, (SERE), IEEE Press, Gaithersburg, MD, June. 2013, pp. 188-197, doi:10.1109/SERE.2013.30.
  21. F. Gauthier and E. Merlo, "Fast detection of Access Control vulnerabilities in PHP applications," Proc. IEEE 19th Working Conference on Reverse Engineering, (WCRE), IEEE Press, Kingston, ON, Oct. 2012, pp. 247-256, doi:10.1109/WCRE.2012.34.
  22. D. Huluka and O. Popov, "Root cause analysis of Session Management and Broken Authentication vulnerabilities," IEEE World Congress on Internet Security, IEEE Press, Guelph, ON, June. 2012, pp. 82-86.
  23. Y. Zheng and X. Zhang, "Path sensitive static analysis of web applications for remote code execution vulnerability detection," Proc. IEEE 35th International Conference on Software Engineering, (ICSE), IEEE Press, San Francisco, CA, May. 2013, pp. 652-661, doi:10.1109/ICSE.2013.6606611.
  24. V. Felmetsger, L. Cavedon, C. Kruegel and G. Vigna, "Toward automated detection of logic vulnerabilities in web applications," Proc. ACM 19th USENIX conference on Security, ACM, Berkeley, CA, USA, 2010, pp. 10-10.
  25. R. A. DeMillo, R. J. Lipton and F. Sayward, "Hints on test data selection: help for the practicing programmer," Computer, vol. 11, iss.
  26. IEEE Press, 2006, pp. 34-41, doi:10.1109/C-M.1978.218136.
  27. C. D. Rosin and R. K. Belew, "New methods for competitive coevolution," in Evolutionary Computation, vol. 5, iss. 1, MIT Press Cambridge, MA, USA, 1997, pp. 1-29.
  28. C. Zhou and P. Frankl, "JDAMA Java database application mutation analyser," ACM Journal of Software Testing, Verification & Reliability, vol. 21, iss. 3, Sept. 2011, pp. 241-263, doi:10.1002/stvr.462.
  29. W. B. Langdon, M. Harman and Y. Jia, "Efficient multi-objective higher order mutation testing with genetic programming," ELSEVIER Journal of Systems and Software, vol. 83, iss. 12, Dec. 2010, pp. 2416- 2430, doi:10.1016/j.jss.2010.07.027.

Related papers

WAP: Automatic detection and correction of web application vulnerabilities
Miguel Correia

2013

Web application security is an important problem in today’s internet. A major cause of this status is that many program-mers do not have adequate knowledge about secure coding, so they leave applications with vulnerabilities. An approach to solve this problem is to use source code static analysis to find these bugs, but these tools are known to report many false positives that make hard the task of correcting the applica-tion. This paper explores the use of a hybrid of methods to detect vulnerabilities with less false positives. After an initial step that uses taint analysis to flag candidate vulnerabilities, our approach uses data mining to predict the existence of false positives. This approach reaches a trade-off between two ap-parently opposite approaches: humans coding the knowledge about vulnerabilities (for taint analysis) versus automatically obtaining that knowledge (with machine learning, for data mining). Given this more precise form of detection, we do au-tomatic code co...

View PDFchevron_right
Automatic detection and correction of web application vulnerabilities using data mining to predict false positives
Miguel Correia

Proceedings of the 23rd international conference on World wide web - WWW '14, 2014

Web application security is an important problem in today's internet. A major cause of this status is that many programmers do not have adequate knowledge about secure coding, so they leave applications with vulnerabilities. An approach to solve this problem is to use source code static analysis to find these bugs, but these tools are known to report many false positives that make hard the task of correcting the application. This paper explores the use of a hybrid of methods to detect vulnerabilities with less false positives. After an initial step that uses taint analysis to flag candidate vulnerabilities, our approach uses data mining to predict the existence of false positives. This approach reaches a trade-off between two apparently opposite approaches: humans coding the knowledge about vulnerabilities (for taint analysis) versus automatically obtaining that knowledge (with machine learning, for data mining). Given this more precise form of detection, we do automatic code correction by inserting fixes in the source code. The approach was implemented in the WAP tool 1 and an experimental evaluation was performed with a large set of open source PHP applications.

View PDFchevron_right
Detecting and Removing Web Application Vulnerabilities with Static Analysis and Data Mining
Miguel Correia

IEEE Transactions on Reliability, 2015

Although a large research effort on web application security has been going on for more than a decade, the security of web applications continues to be a challenging problem. An important part of that problem derives from vulnerable source code, often written in unsafe languages like PHP. Source code static analysis tools are a solution to find vulnerabilities, but they tend to generate false positives, and require considerable effort for programmers to manually fix the code. We explore the use of a combination of methods to discover vulnerabilities in source code with fewer false positives. We combine taint analysis, which finds candidate vulnerabilities, with data mining, to predict the existence of false positives. This approach brings together two approaches that are apparently orthogonal: humans coding the knowledge about vulnerabilities (for taint analysis), joined with the seemingly orthogonal approach of automatically obtaining that knowledge (with machine learning, for data mining). Given this enhanced form of detection, we propose doing automatic code correction by inserting fixes in the source code. Our approach was implemented in the WAP tool, and an experimental evaluation was performed with a large set of PHP applications. Our tool found 388 vulnerabilities in 1.4 million lines of code. Its accuracy and precision were approximately 5% better than PhpMinerII's and 45% better than Pixy's.

View PDFchevron_right
Static analysis for detecting taint-style vulnerabilities in web applications
Nenad Jovanovic

Journal of Computer Security, 2010

View PDFchevron_right
DEKANT: a static analysis tool that learns to detect web application vulnerabilities
Miguel Correia

Proceedings of the 25th International Symposium on Software Testing and Analysis, 2016

The state of web security remains troubling as web applications continue to be favorite targets of hackers. Static analysis tools are important mechanisms for programmers to deal with this problem as they search for vulnerabilities automatically in the application source code, allowing programmers to remove them. However, developing these tools requires explicitly coding knowledge about how to discover each kind of vulnerability. This paper presents a new approach in which static analysis tools learn to detect vulnerabilities automatically using machine learning. The approach uses a sequence model to learn to characterize vulnerabilities based on a set of annotated source code slices. This model takes into consideration the order in which the code elements appear and are executed in the slices. The model created can then be used as a static analysis tool to discover and identify vulnerabilities in source code. The approach was implemented in the DEKANT tool and evaluated experimentally with a set of open source PHP applications and WordPress plugins, finding 16 zero-day vulnerabilities. CCS Concepts •Software and its engineering → Software verification and validation; •Security and privacy → Vulnerability management; Web application security; •Computing methodologies → Machine learning;

View PDFchevron_right

Related topics

  • Engineering
    • 580 California St., Suite 400
    San Francisco, CA, 94104
    © 2025 Academia. All rights reserved