Mining input sanitization patterns for predicting SQL injection and cross site scripting vulnerabilities

Proceedings - International Conference on Software Engineering

Volumn , Issue , 2012, Pages 1293-1296

  Shar, Lwin Khin ^a   Tan, Hee Beng Kuan ^a  

^a NANYANG TECHNOLOGICAL UNIVERSITY   (Singapore)

Author keywords

data mining; defect prediction; input sanitization; static code attributes; web security vulnerabilities

Indexed keywords

CROSS SITE SCRIPTING; CYCLOMATIC COMPLEXITY; DATA MINING METHODS; DEFECT PREDICTION; LINES OF CODE; SANITIZATION; SOFTWARE MODULES; SQL INJECTION; STATIC CODES; WEB APPLICATION; WEB APPLICATION VULNERABILITY; WEB SECURITY;

DATA MINING; DEFECTS; FORECASTING; SECURITY OF DATA; SOFTWARE ENGINEERING;

WORLD WIDE WEB;

EID: 84864239564     PISSN: 02705257     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/ICSE.2012.6227096     Document Type: Conference Paper

References (14)

1. N. F. Schneidewind, "Methodology for validating software metrics," IEEE Trans. Softw. Eng., vol. 18(5), 1992, pp. 410-422.
2. T. McCabe, "A complexity measure," IEEE Trans. Softw. Eng., vol. 2(4), 1976, pp. 308-320.
3. T. Menzies, J. Greenwald, and A. Frank, "Data mining static code attributes to learn defect predictors," IEEE Trans. Softw. Eng., vol. 33(1), 2007, pp. 2-13.
4. S. Lessmann, B. Baesens, C. Mues, and S. Pietsch, "Benchmarking classification models for software defect prediction: a proposed framework and novel findings," IEEE Trans. Softw. Eng., vol. 34(4), 2008, pp. 485-496.
5. T. Zimmermann and N. Nagappan, "Predicting defect using network analysis on dependency graphs," In ICSE'08, 2008, pp. 531-540.
6. N. Jovanovic, C. Kruegel, and E. Kirda, "Pixy: a static analysis tool for detecting web application vulnerabilities," In S&P'06, 2006, pp. 258-263.
7. Y. Xie and A. Aiken, "Static detection of security vulnerabilities in scripting languages," In USENIX Security'06, 2006, pp. 179-192.
8. G. Wassermann and Z. Su, "Static detection of cross-site scripting vulnerabilities," In ICSE'08, 2008, pp. 171-180.
9. A. Kieżun, P. J. Guo, K. Jayaraman, and M. D. Ernst, "Automatic creation of SQL injection and cross-site scripting attacks," In ICSE'09, 2009, pp. 199-209.
10. M. Martin and M. S. Lam, "Automatic generation of XSS and SQL injection attacks with goal-directed model checking," In USENIX Security'08, 2008, pp. 31-43.
11. OWASP Top 10, 2010, http://www.owasp.org/
12. I. H. Witten and E. Frank, Data Mining, 2nd ed., Morgan Kaufmann, Los Altos, CA, 2005.
13. T. Mende, "Replication of defect prediction studies: problems, pitfalls and recommendations," In PROMISE'10, 2010.
14. T. Menzies, Z. Milton, B. Turhan, B. Cukic, Y. Jiang, and A. Bener, "Defect prediction from static code features: current results, limitations, new approaches," Autom. Softw. Eng., vol. 17(4), 2010, pp. 375-407.