Mitigating SQL injection and cross site scripting vulnerabilities using program analysis and data mining techniques

This thesis presents approaches for mitigating SQL injection (SQLI) and cross site scripting (XSS) vulnerabilities, the two most common vulnerabilities found in web applications in recent years.Current approaches to mitigate SQLI and XSS problems can be broadly classified into three types which are defensive coding, vulnerability detection, and attack prevention.Defensive coding approaches provide input validation and input sanitization methods that are effective against SQLI and XSS.Vulnerability detection approaches typically focus on identification of vulnerabilities in program source code.Attack prevention approaches focus on warding off real time attacks during runtime.Although all these approaches are certainly useful and could address some of SQLI and XSS issues, there are some major drawbacks that lead to the continual occurrences of the two vulnerabilities nowadays.Defensive coding approaches are very effective when practiced correctly.However, as these approaches generally require intensive manual work, they are errorprone.Vulnerability detection techniques are useful as they could automatically report vulnerable statements in programs.But these techniques are known to report many false positive cases while they could also miss some vulnerabilities.As these techniques also lack focus on reporting the defense features implemented in the programs, it is difficult for one to identify those false positive and false negative cases.Attack prevention techniques are an effective and efficient solution for deployed applications.But these techniques do not address vulnerabilities in programs.As more sophisticated attack vectors are being discovered, programs with vulnerabilities not removed always risk the possibility of being exploited anytime.Hence, it is clear that complementary or alternative solutions, which are easy to be used and yet effective, are required to comprehensively address the threats of SQLI and XSS.Based on these motivations, in this thesis, we propose three complementing novel approaches which are vulnerability prediction, vulnerability auditing, and vulnerability removal.Overall, all the three proposed approaches are based on program analysis techniques augmented with the use of pattern-based empirical models.In addition, vulnerability prediction approach also involves data mining techniques.We empirically discover interesting patterns from program source code and program execution traces and reflect those patterns in appropriate vii models so that the models can be used for vulnerability prediction, auditing, and removal