Vol.129, No.2, 2021, pp.541-565, doi:10.32604/cmes.2021.017213
OPEN ACCESS
ARTICLE
Combinatorial Method with Static Analysis for Source Code Security in Web Applications
  • Juan Ramón Bermejo Higuera1, Javier Bermejo Higuera1, Juan Antonio Sicilia Montalvo1, Tomás Sureda Riera2, Christopher I. Argyros3, Á. Alberto Magreñán4,*
1 Escuela Superior de Ingeniería y Tecnología, Universidad Internacional de La Rioja, Logroño, La Rioja, 26006, Spain
2 Computer Science Department, University of Alcala, Madrid, 28801, Spain
3 Department of Computing and Technology, Cameron University, Lawton, 73505, Oklahoma, USA
4 Universidad de la Rioja, Logroño, La Rioja, 26006, Spain
* Corresponding Author: Á. Alberto Magreñán. Email:
Received 15 April 2021; Accepted 06 July 2021; Issue published 08 October 2021
Abstract
Security weaknesses in web applications deployed in cloud architectures can seriously affect its data confidentiality and integrity. The construction of the procedure utilized in the static analysis tools of source code security differs and therefore each tool finds a different number of each weakness type for which it is designed. To utilize the possible synergies different static analysis tools may process, this work uses a new method to combine several source codes aiming to investigate how to increase the performance of security weakness detection while reducing the number of false positives. Specifically, five static analysis tools will be combined with the designed method to study their behavior using an updated benchmark for OWASP Top Ten Security Weaknesses (OWASP TTSW). The method selects specific metrics to rank the tools for different criticality levels of web applications considering different weights in the ratios. The findings show that simply including more tools in a combination is not synonymous with better results; it depends on the specific tools included in the combination due to their different designs and techniques.
Keywords
Weakness; benchmark; security testing analysis; comparative methodology; tools combination; web application
Cite This Article
Ramón, J., Higuera, J. B., Antonio, J., Riera, T. S., Argyros, C. I. et al. (2021). Combinatorial Method with Static Analysis for Source Code Security in Web Applications. CMES-Computer Modeling in Engineering & Sciences, 129(2), 541–565.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.