{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,3]],"date-time":"2026-07-03T16:40:51Z","timestamp":1783096851134,"version":"3.54.6"},"reference-count":51,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"6","license":[{"start":{"date-parts":[[2015,11,1]],"date-time":"2015-11-01T00:00:00Z","timestamp":1446336000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"}],"funder":[{"DOI":"10.13039\/501100001866","name":"National Research Fund, Luxembourg","doi-asserted-by":"publisher","award":["FNR\/P10\/03"],"award-info":[{"award-number":["FNR\/P10\/03"]}],"id":[{"id":"10.13039\/501100001866","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Dependable and Secure Comput."],"published-print":{"date-parts":[[2015,11,1]]},"DOI":"10.1109\/tdsc.2014.2373377","type":"journal-article","created":{"date-parts":[[2014,11,20]],"date-time":"2014-11-20T20:37:25Z","timestamp":1416515845000},"page":"688-707","source":"Crossref","is-referenced-by-count":126,"title":["Web Application Vulnerability Prediction Using Hybrid Program Analysis and Machine Learning"],"prefix":"10.1109","volume":"12","author":[{"given":"Lwin Khin","family":"Shar","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lionel C.","family":"Briand","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Hee Beng Kuan","family":"Tan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.7551\/mitpress\/9780262033589.001.0001"},{"key":"ref38","doi-asserted-by":"crossref","DOI":"10.1002\/9781118548387","author":"hosmer jr","year":"2013","journal-title":"Applied Logistic Regression"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2013.6606610"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1145\/77606.77608"},{"key":"ref31","first-page":"439","article-title":"Program slicing","author":"weiser","year":"1981","journal-title":"Proc Int Conf Softw Eng"},{"key":"ref30","doi-asserted-by":"crossref","first-page":"95","DOI":"10.1007\/978-3-642-23702-7_11","article-title":"Directed symbolic execution","author":"ma","year":"2011","journal-title":"Proc Int Conf Static Anal"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1023\/A:1010933404324"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-55860-247-2.50026-7"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2010.90"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2007.256941"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1145\/1250734.1250739"},{"key":"ref27","first-page":"535","article-title":"A string constraint solver for detecting web application vulnerability","author":"fu","year":"2010","journal-title":"Proc Int Conf on Software Eng Knowledge Eng"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2011.12.006"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1016\/j.infsof.2013.04.002"},{"key":"ref1","article-title":"The open web application security project","year":"2012"},{"key":"ref20","first-page":"1","article-title":"Statistical comparisons of classifiers over multiple data sets","volume":"7","author":"dem\u0161ar","year":"2006","journal-title":"J Mach Learning Res"},{"key":"ref22","first-page":"31","article-title":"Automatic generation of XSS and SQL injection attacks with goal-directed model checking","author":"martin","year":"2008","journal-title":"Proc Usenix Security Symp"},{"key":"ref21","first-page":"199","article-title":"Automatic creation of SQL injection and cross-site scripting attacks","author":"kie?un","year":"2009","journal-title":"Proc Int Conf Softw Eng"},{"key":"ref24","first-page":"545","article-title":"Security of open source web applications","author":"walden","year":"2009","journal-title":"Proc Int'l Symp Empirical Software Eng and Measurement"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2010.81"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1145\/1315245.1315311"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/ISSRE.2006.50"},{"key":"ref50","article-title":"Correlation-based feature selection for machine learning","author":"hall","year":"1998"},{"key":"ref51","year":"0"},{"key":"ref10","year":"2012"},{"key":"ref11","first-page":"387","article-title":"Saner: Composing static and dynamic analysis to validate sanitization in web applications","author":"balzarotti","year":"2008","journal-title":"Proc IEEE Symp Security Privacy"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-011-0092-1"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1016\/S0164-1212(99)00102-8"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2009.06.055"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2008.35"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1007\/s10515-010-0069-5"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351733"},{"key":"ref17","author":"anley","year":"2002","journal-title":"Advanced SQL Injection In SQL Server Applications"},{"key":"ref18","article-title":"Web application vulnerabilities: Detect, exploit","author":"palmer","year":"2007"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/ESEM.2007.28"},{"key":"ref4","first-page":"179","article-title":"Static detection of security vulnerabilities in scripting languages","author":"xie","year":"2006","journal-title":"Proc Usenix Security Symp"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2006.29"},{"key":"ref6","year":"2013"},{"key":"ref5","year":"2012"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1145\/24039.24041"},{"key":"ref7","year":"0"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2008.239"},{"key":"ref9","author":"witten","year":"2011","journal-title":"Data Mining"},{"key":"ref46","first-page":"499","article-title":"Chucky: Exposing missing checks in source code for vulnerability discovery","author":"yamaguchi","year":"2013","journal-title":"Proc ACM SIGSAC Conf Comput Commun Security"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1145\/2420950.2421003"},{"key":"ref48","first-page":"1322","article-title":"ADASYN: Adaptive synthetic sampling approach for imbalanced learning","author":"he","year":"2008","journal-title":"Proc Int Joint Conf Neural Netw"},{"key":"ref47","year":"0"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCA.2007.904745"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1145\/2351676.2351734"},{"key":"ref44","article-title":"Chord: A versatile platform for program analysis","year":"2011","journal-title":"Proc Tutorial ACM Conf Program Language Des Implementation"},{"key":"ref43","doi-asserted-by":"crossref","first-page":"529","DOI":"10.1007\/978-3-642-02326-2_53","article-title":"When semi-supervised learning meets ensemble learning","author":"zhou","year":"2009","journal-title":"Proc Int Workshop Multiple Classifier Syst"}],"container-title":["IEEE Transactions on Dependable and Secure Computing"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx7\/8858\/7322332\/06963442.pdf?arnumber=6963442","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2022,4,22]],"date-time":"2022-04-22T23:53:32Z","timestamp":1650671612000},"score":1,"resource":{"primary":{"URL":"http:\/\/ieeexplore.ieee.org\/document\/6963442\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2015,11,1]]},"references-count":51,"journal-issue":{"issue":"6"},"URL":"https:\/\/doi.org\/10.1109\/tdsc.2014.2373377","relation":{},"ISSN":["1545-5971"],"issn-type":[{"value":"1545-5971","type":"print"}],"subject":[],"published":{"date-parts":[[2015,11,1]]}}}