Abstract

In this project, we propose a methodology to leverage Machine Learning (ML) for the detection of web application vulnerabilities. Web applications are particularly challenging to analyses, due to their diversity and the widespread adoption of custom programming practices. Machine Learning is thus very helpful for web application security: it can take advantage of manually labeled data to bring the human understanding of the web application semantics into automated analysis tools. We use our methodology in the design of Mitch, the first Machine Learning solution for the black-box detection of Cross-Site Request Forgery (CSRF) vulnerabilities. According to the recent research, Mitch identified 35 new CSRFs on 20 major websites and 3 new CSRFs on production software

Description