冯登国,张敏,张妍,等.云计算安全研究[J].软件学报,2011,22(1):71-83.DOI:10.3724/SP.J.1001.2011.03958.FENG D G,ZHANG M,ZHANG Y,et al.Study on cloud computing security[J].Journal o f Software,2011,22(1):71-83.DOI:10.3724/SP.J.1001.2011.03958(Ch).
[2]
BISHT P,HINRICHS T,SKRUPSKY N,et al.WAPTEC:White box analysis of Web applications for parameter tampering exploit construction[C]//Proceedings o f the 18th ACM Con ference on Computer and Communications Security.New York:ACM,2011:575-586.DOI:10.1145/2046707.2046774.
[3]
LI X,XUE Y.LogicScope:Automatic discovery of logic vulnerabilities within web applications[C]//Proceedings of the 8th ACM SIGSAC Symposium on Information,Computer and Communications Security.New York:ACM,2013:481-486.DOI:10.1145/2484313.2484375.
[4]
ZHAO J,CHEN S,LIANG S,et al.RFSM-fuzzing a smart fuzzing algorithm based on regression FSM[C]//P2P,Parallel,Grid,Cloud and Internet Computing(3PGCIC),2013 Eighth International Conference on IEEE.New York:IEEE,2013:380-386.DOI:10.1109/3PGCIC.2013.65.
DEEPA G,THILAGAM P S.Securing web applications from injection and logic vulnerabilities:Approaches and challenges[J].In formation and Software Technology,2016,74:160-180.DOI:10.1016/j.infsof.2016.02.005.
[7]
HAN X,WEN Q,ZHANG Z.A mutation-based fuzz testing approach for network protocol vulnerability detection[C]//Computer Science and Network Technology(ICCSNT).2012 2nd International Conference on IEEE.New York:IEEE,2012:1018-1022.DOI:10.1109/ICCSNT.2012.6526099.
[8]
BISHT P,HINRICHS T,SKRUPSKY N,et al.NoTamper:Automatic blackbox detection of parameter tampering opportunities in web applications[C]//Proceedings o f the 17th ACM Conference on Computer and Communications Security.New York:ACM,2010:607-618.DOI:10.1145/1866307.1866375.
[9]
BALDUZZI M,GIMENEZ C T,BALZAROTTI D,et al.Automated discovery of parameter pollution vulnerabilities in Web applications[DB/OL].[2017-03-21].http://www.iseclab.net/papers/balduzzi-ndssll.pdf.
[10]
TSANKOV P,DASHTI M T,BASIN D.SECFUZZ:Fuzz-testing security protocols[C]//Automation o f Software Test(AST),2012 7th International Workshop on IEEE.Piscataway:IEEE Press,2012:1-7.DOI:10.1109/IWAST.2012.6228985.
[11]
DOUPEA,COVA M,VIGNA G.Why Johnny can't pentest:An analysis of black-box web vulnerability scanners[C]//International Conference on Detection of Intrusions and Malware,and Vulnerability Assessment.Berlin:Springer-Verlag,2010:111-131.DOI:10.1007/978-3-642-14215-4_7.
[12]
OWAS P.Category:OWASP Top Ten Project[EB/OL].[2017-11-19].https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project.
[13]
ALKHALAF M,CHOUDHARY S R,FAZZINI M,et al.Viewpoints:Differential string analysis for discovering client-and server-side input validation inconsistencies[C]//Proceedings o f the 2012 International Symposium on So ft ware Testing and Analysis.New York:ACM,2012:56-66.DOI:10.1145/2338965.2336760.
