An injection flaw is the result of an invalidated input. Some input validation programs are poorly written, lacking even the most basic security procedures for constraining input. Enforcing proper input validation is an effective countermeasure to use as a defense against injection attacks. However it may induce some detection errors because of improper sanitizing rules. In this paper, we propose a heuristic mechanism that can automatically generate proper validation rules based on each vulnerable injection point. The method can also both guarantee security (false negatives) and convenience (false positives). The experimental results show that our method has better detection accuracy while compared with other constraining strategies.
Bitte loggen Sie sich ein, um Zugang zu diesem Inhalt zu erhalten
