A clustering approach for web vulnerabilities detection

Anthony Dessiatnikoff (1) , Rim Akrout (1) , Eric Alata (1) , Mohamed Kaâniche (1) , Vincent Nicomette (1)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique

This paper presents a new algorithm aimed at the vulnerability assessment of web applications following a blackbox approach. The objective is to improve the detection efficiency of existing vulnerability scanners and to move a step forward toward the automation of this process. Our approach covers various types of vulnerabilities but this paper mainly focuses on SQL injections. The proposed algorithm is based on the automatic classification of the responses returned by the web servers using data clustering techniques and provides especially crafted inputs that lead to successful attacks when vulnerabilities are present. Experimental results on several vulnerable applications and comparative analysis with some existing tools confirm the effectiveness of our approach.

Mots clés: Web security assessment; web scanners; Web vulnerabilities; clustering; dynamic analysis

Domaines: Performance et fiabilité [cs.PF]; Cryptographie et sécurité [cs.CR]

Anthony Dessiatnikoff, Rim Akrout, Eric Alata, Mohamed Kaâniche, Vincent Nicomette. A clustering approach for web vulnerabilities detection. 17th IEEE Pacific Rim International Symposium on Dependable Computing (PRDC 2011), Dec 2011, Pasadena, CA, United States. pp.194-203, ⟨10.1109/PRDC.2011.31⟩. ⟨hal-00755212⟩