Identify And Eliminating Online Application Misbehaviors by Static Analysis Approach

Abstract

An extensive research work on web application security has been continuing for over 10 years, the security of web applications keeps on being a difficult issue. An essential some portion of that issue gets from unprotected source code, regularly written in risky dialects like PHP. Source code static investigation devices are response for discover vulnerabilities, however they have a tendency to produce false positives, and require extensive work for software engineers to resolve the code. We investigate the utilization of a mix of strategies to find vulnerabilities in source code with less false positives. We combine Taint analysis, which discovers hopeful vulnerabilities, with information mining, to predict the presence of false positives. This approach unites two methodologies that are obviously orthogonal: people coding the information about vulnerabilities (for Taint Analysis), joined with the apparently orthogonal approach of consequently getting that information (with machine learning, for information mining). Given this upgraded type of detection, we propose doing programmed code remedy by embeddings settles in the source code. Our approach was executed in the WAP device, and an investigative assessment was performed with an expansive arrangement of PHP applications. Our apparatus discovered 388 vulnerabilities in 1.4 million lines of code. Its exactness and accuracy were roughly 5% superior to PhpMinerII's and 45% superior to Pixy's.