TPSQLi: Test Prioritization for SQL Injection Vulnerability Detection in Web Applications
Source abstract
Abstract
The rapid proliferation of network applications has led to a significant increase in network attacks. According to the OWASP Top 10 Projects report released in 2021, injection attacks rank among the top three vulnerabilities in software projects. This growing threat landscape has increased the complexity and workload of software testing, necessitating advanced tools to support agile development cycles. This paper introduces a novel test prioritization method for SQL injection vulnerabilities to enhance testing efficiency. By leveraging previous test outcomes, our method adjusts defense strength vectors for subsequent tests, optimizing the testing workflow and tailoring defense mechanisms to specific software needs. This approach aims to improve the effectiveness and efficiency of vulnerability detection and mitigation through a flexible framework that incorporates dynamic adjustments and considers the temporal aspects of vulnerability exposure.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Web Application Security Vulnerabilities · Software Testing and Debugging Techniques · Software Reliability and Analysis Research
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Electrical Engineering, National Taiwan University, Taipei City 106319, Taiwan
CyberLink Corporation, New Taipei City 231023, Taiwan
Institute of Artificial Intelligence Innovation, National Yang Ming Chiao Tung University, Hsinchu City 300093, Taiwan
Department of Information Management, National Dong Hwa University, Hualien 974301, Taiwan
Funding
National Science and Technology Council (NSTC), Taiwan, ROC · 2024 CITI Visible Project: Questionnaire-based Technology for App Layout Evaluation, Academia Sinica, Taiwan, ROC
References (32)
Show source-provided references
1. Integrated approach to prevent SQL injection attack and reflected cross site scripting attack10.1007/s13198-012-0125-6 ↗
2. Ravindran, R., Abhishek, S., Anjali, T., and Shenoi, A. (2023, January 8–9). Fortifying Web Applications: Advanced XSS and SQLi Payload Constructor for Enhanced Security. Proceedings of the International Conference on Information and Communication Technology for Competitive Strategies, Jaipur, India.10.1007/978-981-97-1260-1_35 ↗
3. Odion, T.O., Ebo, I.O., Imam, R.M., Ahmed, A.I., and Musa, U.N. (2023, January 5–7). VulScan: A Web-Based Vulnerability Multi-Scanner for Web Application. Proceedings of the 2023 International Conference on Science, Engineering and Business for Sustainable Development Goals (SEB-SDG), Kwara, Nigeria.10.1109/SEB-SDG57117.2023.10124601 ↗
4. (2024, July 11). OWASP Top Ten. Available online: https://owasp.org/www-project-top-ten/.
5. A literature review and comparative analyses on sql injection: Vulnerabilities, attacks and their prevention and detection techniques
6. Wang, F., Wu, J.-H., Huang, C.-H., and Chang, K.-H. (April, January 26). Evolving a test oracle in black-box testing. Proceedings of the Fundamental Approaches to Software Engineering: 14th International Conference, FASE 2011, Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2011, Saarbrücken, Germany.
7. (2024, July 15). OWASP ZAP. Available online: https://www.zaproxy.org/.
8. (2024, June 28). Sqlmap. Available online: https://sqlmap.org.
9. ART4SQLi: The ART of SQL injection vulnerability discovery10.1109/TR.2019.2910285 ↗
10. Software debugging, testing, and verification10.1147/sj.411.0004 ↗
11. Spillner, A., and Linz, T. (2021). Software Testing Foundations: A Study Guide for the Certified Tester Exam-Foundation Level-ISTQB® Compliant, Dpunkt. Verlag.
12. Regression testing minimization, selection and prioritization: A survey10.1002/stvr.430 ↗
13. Huang, G.-D., and Wang, F. (2005, January 4–7). Automatic test case generation with region-related coverage annotations for real-time systems. Proceedings of the International Symposium on Automated Technology for Verification and Analysis, Taipei, Taiwan.10.1007/11562948_13 ↗
14. Strandberg, P.E., Sundmark, D., Afzal, W., Ostrand, T.J., and Weyuker, E.J. (2016, January 23–27). Experience report: Automated system level regression test prioritization using multiple factors. Proceedings of the 2016 IEEE 27th International Symposium on Software Reliability Engineering (ISSRE), Ottawa, ON, Canada.10.1109/ISSRE.2016.23 ↗
15. A systematic literature review of test case prioritization using genetic algorithms10.1109/ACCESS.2019.2938260 ↗
16. Elbaum, S., Rothermel, G., and Penix, J. (2014, January 16–21). Techniques for improving regression testing in continuous integration development environments. Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering, Hong Kong, China.10.1145/2635868.2635910 ↗
17. Automated system-level regression test prioritization in a nutshell10.1109/MS.2017.92 ↗
18. Wang, F., and Huang, G.-D. (2008, January 10–13). Test Plan Generation for Concurrent Real-Time Systems Based on Zone Coverage Analysis. Proceedings of the International Workshop on Formal Approaches to Software Testing, Tokyo, Japan.10.1007/978-3-540-68524-1_17 ↗
19. Marchand-Melsom, A., and Nguyen Mai, D.B. (July, January 27). Automatic repair of OWASP Top 10 security vulnerabilities: A survey. Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops, Seoul, Republic of Korea.
20. Bobade, N.D., Sinha, V.A., and Sherekar, S.S. (2024, January 24–25). A diligent survey of SQL injection attacks, detection and evaluation of mitigation techniques. Proceedings of the 2024 IEEE International Students’ Conference on Electrical, Electronics and Computer Science (SCEECS), Bhopal, India.10.1109/SCEECS61402.2024.10481914 ↗
21. Marashdeh, Z., Suwais, K., and Alia, M. (2021, January 14–15). A survey on sql injection attack: Detection and challenges. Proceedings of the 2021 International Conference on Information Technology (ICIT), Amman, Jordan.10.1109/ICIT52682.2021.9491117 ↗
22. Al Wahaibi, S., Foley, M., and Maffeis, S. (2023, January 9–11). {SQIRL}:{Grey-Box} Detection of {SQL} Injection Vulnerabilities Using Reinforcement Learning. Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), Anaheim, CA, USA.
23. Detecting SQL injection attacks by binary gray wolf optimizer and machine learning algorithms10.1007/s00521-024-09429-z ↗
24. A systematic review of detection and prevention techniques of SQL injection attacks10.1080/19393555.2021.1995537 ↗
25. Simulating SQL injection vulnerability exploitation using Q-learning reinforcement learning agents
26. An ensemble classification-based approach to detect attack level of SQL injections
27. Chen, J., Lou, Y., Zhang, L., Zhou, J., Wang, X., Hao, D., and Zhang, L. (2018, January 4–9). Optimizing test prioritization via test distribution analysis. Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering, Lake Buena Vista, FL, USA.10.1145/3236024.3236053 ↗
28. Test prioritization in continuous integration environments10.1016/j.jss.2018.08.061 ↗
29. Alptekin, H., Demir, S., Şimşek, Ş., and Yilmaz, C. (2020, January 11–14). Towards prioritizing vulnerability testing. Proceedings of the 2020 IEEE 20th International Conference on Software Quality, Reliability and Security Companion (QRS-C), Macau, China.10.1109/QRS-C51114.2020.00114 ↗
30. Trustworthiness models to categorize and prioritize code for security improvement10.1016/j.jss.2023.111621 ↗
31. Dynamic analysis tool for detecting SQL injection
32. (2024, June 28). HITCON ZeroDay. Available online: https://zeroday.hitcon.org/.