Report Comprehension and Reproduction of Web Application Vulnerability
CSTR:
Author:
Affiliation:

Clc Number:

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    As Web applications become increasingly complex, their security issues happen frequently. Web application security testing has become one of the research priorities in the field of software testing. Vulnerability reports aim to document Web application security issues and assist Web application testing to improve its security and quality. However, how to automatically identify the key information in vulnerability reports and reproduce the vulnerability is still a research challenge. To this end, this study proposes an automatic approach to comprehend vulnerability reports and reproduce the vulnerability. Firstly, based on the characteristics of vulnerability reports, the study summarizes their grammar dependency patterns and combines them with dependency syntactic parsing techniques to parse vulnerability descriptions and extract key information about vulnerability triggers. Secondly, unlike conventional natural language descriptions, the payload of Web vulnerability is usually an illegal string, mostly in the form of a code fragment. For this reason, the study designs extraction rules for the payload solely to improve the extraction of vulnerability reports. On this basis, considering that vulnerability reports and Web application text descriptions are different but semantically similar, the study proposes a semantic similarity-based method to achieve the automatic reproduction of Web application vulnerability. To verify the effectiveness of this study, 400 vulnerability reports are collected from more than 300 Web application projects in the vulnerability collection platform Exploit-db, and their grammar dependency patterns are summarized. A total of 26 real vulnerability reports involving 23 open-source Web applications are used for vulnerability reproduction experiments. The results show that the proposed method can effectively extract key information from vulnerability reports and generate feasible test scripts to reproduce vulnerability, reducing manual operations, and improving the efficiency of vulnerability reproduction.

    Reference
    Related
    Cited by
Get Citation

李子东,王微微,尤枫,杨羊,赵瑞莲. Web应用漏洞报告理解及漏洞复现.计算机系统应用,2023,32(11):62-72

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:April 10,2023
  • Revised:May 11,2023
  • Adopted:
  • Online: September 15,2023
  • Published:
Article QR Code
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-3
Address:4# South Fourth Street, Zhongguancun,Haidian, Beijing,Postal Code:100190
Phone:010-62661041 Fax: Email:csa (a) iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063