Finding security vulnerabilities in Java web applications with test generation and dynamic taint analysis

Abstract

This paper investigates how to combine techniques of static and dynamic analysis for finding security vulnerabilities in Java web applications. We present a hybrid analyzer that employs test case generation and dynamic taint analysis to achieve the goal of no false negatives and reduced false positives. © 2012 Springer-Verlag GmbH.