The DOI matches its Crossref record.
Web application security assessment by fault injection and behavior monitoring
Abstract
As a large and complex application platform, the World Wide Web is capable of delivering a broad range of sophisticated applications. However, many Web applications go through rapid development phases with extremely short turnaround time, making it difficult to eliminate vulnerabilities. Here we analyze the design of Web application security assessment mechanisms in order to identify poor coding practices that render Web applications vulnerable to attacks such as SQL injection and cross-site scripting. We describe the use of a number of software-testing techniques (including dynamic analysis, black-box testing, fault injection, and behavior monitoring), and suggest mechanisms for applying these techniques to Web applications. Real-world situations are used to test a tool we named the Web Application Vulnerability and Error Scanner (WAVES, an open-source project available at http://waves.sourceforge.net) and to compare it with other tools. Our results show that WAVES is a feasible platform for assessing Web application security.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cited by
Pixy: a static analysis tool for detecting Web application vulnerabilities
Jovanovic, N., Kruegel, C., & Kirda, E. (2006) · 2006 IEEE Symposium on Security and Privacy (S&P'06) · doi:10.1109/sp.2006.29 · Cited by 722
Securing web application code by static analysis and runtime protection
Huang, Y.-W., Yu, F., Hang, C., Tsai, C.-H., Lee, D.-T., & Kuo, S.-Y. (2004) · Proceedings of the 13th international conference on World Wide Web · doi:10.1145/988672.988679 · Cited by 567
Self-citationAMNESIA: analysis and monitoring for NEutralizing SQL-injection attacks
Halfond, W. G. J., & Orso, A. (2005) · Proceedings of the 20th IEEE/ACM International Conference on Automated Software Engineering · doi:10.1145/1101908.1101935 · Cited by 527
The essence of command injection attacks in web applications
Su, Z., & Wassermann, G. (2006) · Conference record of the 33rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages · doi:10.1145/1111037.1111070 · Cited by 515
Ghosh, P., Patecki, M., Rothe, M., & Brand, W. A. (2005) · Rapid Communications in Mass Spectrometry · doi:10.1002/rcm.1886 · Cited by 77
Metadata
- Authors
- Huang, Y.-W., Huang, S.-K., Lin, T.-P., & Tsai, C.-H.
- Venue
- Proceedings of the twelfth international conference on World Wide Web - WWW '03
- Publisher
- ACM Press
- Published
- 2003
- Pages
- 148
- OpenAlex
- W2003115932
- Cited by
- 319
- References
- 0
- Type
- conference abstract
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: Web application security assessment by fault injection and behavior monitoring. https://app.cochat.ai/papers/10.1145/775152.775174
- The paper
- Huang, Y.-W., Huang, S.-K., Lin, T.-P., & Tsai, C.-H. (2003). Web application security assessment by fault injection and behavior monitoring. Proceedings of the twelfth international conference on World Wide Web - WWW '03. https://doi.org/10.1145/775152.775174
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
