NDLI: DEKANT: a static analysis tool that learns to detect web application vulnerabilities

Please wait, while we are loading the content...

DEKANT: a static analysis tool that learns to detect web application vulnerabilities

Binary code is not easy

Generating focused random tests using directed swarm testing

CSNIPPEX: automated synthesis of compilable code snippets from Q&A sites

Practitioners' expectations on automated fault localization

Automatic generation of oracles for exceptional behaviors

DSI: an evidence-based approach to identify dynamic data structures in C programs

Semantic modelling of Android malware for effective malware comprehension, detection, and classification

Mutation-aware fault prediction

Efficient race detection in the presence of programmatic event loops

Zero-overhead profiling via EM emanations

COSTOTest: a tool for building and running test harness for service-based component models (demo)

Automated and effective testing of web services for XML injection attacks

Specification of concretization and symbolization policies in symbolic execution

Monkey see, monkey do: effective generation of GUI tests with inferred macro events

Automatic test case generation: what if test code quality matters?

A learning-to-rank based fault localization approach using likely invariants

Verdict machinery: on the need to automatically make sense of test results

Documenting database usages and schema constraints in database-centric applications

DroidRA: taming reflection to support whole-program analysis of Android apps

Predictive mutation testing

Automatically verifying and reproducing event-based races in Android apps

Efficient flow profiling for detecting performance bugs

ASTOR: a program repair library for Java (demo)

EagerMerge: an optimistic technique for efficient points-to analysis

Sapienz: multi-objective automated testing for Android applications

Analyzing test completeness for dynamic languages

Optimal sanitization synthesis for web application vulnerability repair

Testing stochastic software using pseudo-oracles

Exploring regular expression usage and context in Python

Threats to the validity of mutation-based test assessment

SyncProf: detecting, localizing, and optimizing synchronization bottlenecks

Energy-aware test-suite minimization for Android apps

Jolinar: analysing the energy footprint of software applications (demo)

IPA: improving predictive analysis with pointer analysis

FSX: fine-grained incremental unit test generation for C/C++ programs

Unveiling anomalies and their impact on software quality in model-based automotive software revisions with software metrics and domain experts

ARROW: automated repair of races on client-side web pages

Test oracle assessment and improvement

Toward understanding compiler bugs in GCC and LLVM

PIT: a practical mutation testing tool for Java (demo)

DEKANT: a static analysis tool that learns to detect web application vulnerabilities

Content Provider	ACM Digital Library
Author	Correia, Miguel Medeiros, Ibéria Neves, Nuno
Abstract	The state of web security remains troubling as web applications continue to be favorite targets of hackers. Static analysis tools are important mechanisms for programmers to deal with this problem as they search for vulnerabilities automatically in the application source code, allowing programmers to remove them. However, developing these tools requires explicitly coding knowledge about how to discover each kind of vulnerability. This paper presents a new approach in which static analysis tools learn to detect vulnerabilities automatically using machine learning. The approach uses a sequence model to learn to characterize vulnerabilities based on a set of annotated source code slices. This model takes into consideration the order in which the code elements appear and are executed in the slices. The model created can then be used as a static analysis tool to discover and identify vulnerabilities in source code. The approach was implemented in the DEKANT tool and evaluated experimentally with a set of open source PHP applications and WordPress plugins, finding 16 zero-day vulnerabilities. .
Starting Page	1
Ending Page	11
Page Count	11
File Format	PDF
ISBN	9781450343909
DOI	10.1145/2931037.2931041
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2016-07-18
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Web application Machine learning Static analysis Vulnerabilities Sequence models Software security
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in