Web application security assessment by fault injection and behavior monitoring

By Yao-Wen Huang, Shih-Kun Huang, Tsung-Po Lin, Chung-Hung Tsai. The Web Conference, 2003

407 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/79136e5a1eb8799b068a8d59fddaf670b2a82cb8

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

AMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks (2005, result): “Huang and colleagues [12] propose WAVES, a black-box technique for testing web applications for SQL-injection vulnerabilities.”
Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications (2008, background): “The dynamic part of our work is also related to a number of research results and tools in the areas of application security testing and fault injection [3,12,19,29,37,40].”
Pixy: a static analysis tool for detecting Web application vulnerabilities (2006, methodology): “Dynamic tools (e.g., [9] [18] [21], and Perl's taint mode try to detect attacks while executing the audited program, whereas static analyzers ([10] [11] [15] [16]) scan the Web application's source code for vulnerabilities.”
Using parse tree validation to prevent SQL injection attacks (2005, background): “Recently, Halfond and Orso combined these static analysis techniques with dynamic verification [10, 11].”
AppsPlayground: automatic security analysis of smartphone applications (2013, methodology): “The approach of automatically filling in text fields has also been used for web form completion [11, 23].”
The essence of command injection attacks in web applications (2006, background): “One from the research community is called WAVES (Web Application Vulnerability and Error Scanner) [14].”
Securing web application code by static analysis and runtime protection (2004, unknown): “WWW 2004, May 17 22, 2004, New York, New York, USA.”