Predicting common web application vulnerabilities from input validation and sanitization code patterns

TLDR

Defect prediction using static code attributes is effective, yet new methods are needed to detect common web application vulnerabilities such as SQL injection and XSS. The study aims to predict SQL injection and cross‑site scripting vulnerabilities by extracting static code attributes from input validation and sanitization routines. The authors defined a set of static code attributes that capture the characteristics of these routines and used them to build vulnerability predictors. The predictors detected over 80 % of vulnerabilities in the test subjects while maintaining low false‑alarm rates.

Abstract

Software defect prediction studies have shown that defect predictors built from static code attributes are useful and effective. On the other hand, to mitigate the threats posed by common web application vulnerabilities, many vulnerability detection approaches have been proposed. However, finding alternative solutions to address these risks remains an important research problem. As web applications generally adopt input validation and sanitization routines to prevent web security risks, in this paper, we propose a set of static code attributes that represent the characteristics of these routines for predicting the two most common web application vulnerabilities—SQL injection and cross site scripting. In our experiments, vulnerability predictors built from the proposed attributes detected more than 80% of the vulnerabilities in the test subjects at low false alarm rates.