维普中文期刊产品整合服务

Benchmarking Approach to Compare Web Applications Static Analysis Tools Detecting OWASP Top Ten Security Vulnerabilities

查看全文 作　　者：Juan R.Bermejo [1]Higuera;Javier Bermejo [1]Higuera;Juan A.Sicilia [1]Montalvo;Javier Cubo [1]Villalba;Juan JoséNombela [1]Pérez 高影响力作者 机构地区：[1]Escuela Superior de Ingeniería y Tecnología,Universidad Internacional de La Rioja,La Rioja,26006,Spain高影响力机构 出　　处：《Computers, Materials & Continua》索引2020年第9期,共23页高影响力期刊 摘　　要：To detect security vulnerabilities in a web application,the security analyst must choose the best performance Security Analysis Static Tool(SAST)in terms of discovering the greatest number of security vulnerabilities as possible.To compare static analysis tools for web applications,an adapted benchmark to the vulnerability categories included in the known standard Open Web Application Security Project(OWASP)Top Ten project is required.The information of the security effectiveness of a commercial static analysis tool is not usually a publicly accessible research and the state of the art on static security tool analyzers shows that the different design and implementation of those tools has different effectiveness rates in terms of security performance.Given the significant cost of commercial tools,this paper studies the performance of seven static tools using a new methodology proposal and a new benchmark designed for vulnerability categories included in the known standard OWASP Top Ten project.Thus,the practitioners will have more precise information to select the best tool using a benchmark adapted to the last versions of OWASP Top Ten project.The results of this work have been obtaining using widely acceptable metrics to classify them according to three different degree of web application criticality. 关 键 词：Web application benchmark security vulnerability Security Analysis Static Tools assessment methodology false positive false negative precision F-MEASURE
相关文献

参考文献(53)

引证文献(6)

网站首页 | 关于我们 | 联系我们 | 产品服务 | 客服中心 | 广告服务 | 版权声明 | 网站联盟 | 友情链接 | 售卡网点

版权所有© 渝B2-20050021-1　渝公网安备 50019002500403号　违法和不良信息举报中心

互联网出版许可证 新出网证(渝)字10号 全国400电话 - 免长途话费