Mining SQL injection and cross site scripting vulnerabilities using hybrid program analysis

Abstract

Abstract-In previous work, we proposed a set of static attributes that characterize input validation and input sanitization code patterns. We showed that some of the proposed static attributes are significant predictors of web application vulnerabilities related to SQL injection and cross site scripting. Static attributes have the advantage of reflecting general properties of a program. Yet, dynamic attributes collected from execution traces may reflect more specific code characteristics that are complementary to static attributes. Hence, to improve our initial work, in this paper, we propose the use of dynamic attributes to complement static attributes in the prediction of vulnerabilities. Furthermore, since existing work relies on supervised learning, it is dependent on the availability of training data labeled with known vulnerabilities. This paper presents prediction models that are based on both classification and clustering in order to predict vulnerabilities, working in the presence or absence of labeled training data, respectively. In our experiments across six applications, our new supervised vulnerability predictors based on hybrid (static and dynamic) attributes achieved, on average, 90% recall and 85% precision, that is a sharp increase in recall when compared to static analysis-based predictions. Though not nearly as accurate, our unsupervised predictors based on clustering achieved, on average, 76% recall and 39% precision, thus suggesting they can be useful in the absence of labeled training data.Index Terms-Defect prediction, vulnerability, input validation and sanitization, static and dynamic analysis, empirical study.

Web Security: Detection of Cross Site Scripting in PHP Web Application using Genetic Algorithm

“…On several occasions, the usage of static analysis offers a high false positive rate. Shar et al [12] employed the static analysis for addressing the nodes and dynamic analysis for determining the vulnerable nodes. However, the hybrid methodology espoused by them is marred by the false positive rate of the static analysis and the lack of precision in the dynamic analysis results.…”

“…Although there are several methodologies employed for detecting XSS vulnerability [7,10,11,12,16,17], the threats of XSS continue to persist. Thus, the aim of this paper is to enhance the detection methodologies by eradicating the infeasible paths, thereby reducing the false positive rate of locating XSS vulnerability.…”

“…Dynamic analysis detects vulnerabilities by analyzing the information obtained during program execution [24]. The combination of static and dynamic analyses is a hybrid approach; dynamic analysis techniques improve the false alarms of static analysis approaches and provide accurate results [12]. However, experimental results show that a straightforward hybrid approach is unlikely to be superior to a fully static or a fully dynamic detection [8].…”

Cross Site Scripting: Detection Approaches in Web Application

“…On the other hand, [27] proposed an approach based on static analysis with GA on Java web applications. Their approach combines the detection approach from [26] and the removal approach from [25]. [27] approach detects XSS vulnerabilities with significant results as compared with the approach of [25].…”

“…Hybrid analysis combines static and dynamic analyses as a better approach, but the combined approach was focused on to benefit from the two types of analyses (static and dynamic) [25]; nevertheless, it still has some problems in terms of the accuracy of its result, such as the training data.…”