Most cited papers in Web Application Security Vulnerabilities
What are the most cited papers in Web Application Security Vulnerabilities?
The most cited paper in Web Application Security Vulnerabilities is "Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software" (James Newsome, Dawn Xiaodong Song, 2018), with 1,287 citations. Next come "Period04 User Guide" (1,094) and "Analyzing inter-application communication in Android" (847).
Showing 50 of 100 papers. Every paper with more than 179 citations is listed.
| # | Paper | ||
|---|---|---|---|
| 1 | Dynamic Taint Analysis for Automatic Detection, Analysis, and Signature Generation of Exploits on Commodity Software James Newsome, Dawn Xiaodong Song · Figshare | 29 Jun 2018 | 1,287 |
| 2 | Period04 User Guide Patrik Lenz · Communications in Asteroseismology | 2007 | 1,094 |
| 3 | Analyzing inter-application communication in Android Erika Chin, Adrienne Porter Felt, Kate Greenwood et al. | 28 Jun 2011 | 847 |
| 4 | Comparison and Evaluation of Clone Detection Tools Stefan Bellon, Rainer Koschke, Giulio Antoniol et al. · IEEE Transactions on Software Engineering | 22 Aug 2007 | 787 |
| 5 | Pixy: a static analysis tool for detecting Web application vulnerabilities Nenad M. Jovanovic, Christopher Kruegel, Engin Kirda | 2006 | 727 |
| 6 | All You Ever Wanted to Know about Dynamic Taint Analysis and Forward Symbolic Execution (but Might Have Been Afraid to Ask) Edward J. Schwartz, Thanassis Avgerinos, David Brumley | 2010 | 715 |
| 7 | Common Vulnerability Scoring System Peter Mell, Karen A. Scarfone, Sasha Romanosky · IEEE Security & Privacy | Nov 2006 | 690 |
| 8 | Countering code-injection attacks with instruction-set randomization Gaurav S. Kc, Angelos D. Keromytis, Vassilis Prevelakis | 27 Oct 2003 | 655 |
| 9 | SySeVR: A Framework for Using Deep Learning to Detect Software Vulnerabilities Zhen Li, Deqing Zou, Shouhuai Xu et al. · IEEE Transactions on Dependable and Secure Computing | 9 Feb 2021 | 633 |
| 10 | CHEX Long Jason Lu, Zhichun Li, Zhenyu Wu et al. | 15 Oct 2012 | 596 |
| 11 | Finding security vulnerabilities in java applications with static analysis V. Benjamin Livshits, Monica S. Lam | 31 Jul 2005 | 583 |
| 12 | Detection and analysis of drive-by-download attacks and malicious JavaScript code Marco Cova, Christopher Kruegel, Giovanni Vigna | 26 Apr 2010 | 577 |
| 13 | Securing web application code by static analysis and runtime protection Yao‐Wen Huang, Fang Yu, Christian Hang et al. | 17 May 2004 | 568 |
| 14 | An approach to detecting duplicate bug reports using natural language and execution information Xiaoyin Wang, Lu Zhang, Tao Xie et al. | 10 May 2008 | 547 |
| 15 | Dytan James Clause, Wanchun Li, Alessandro Orso | 9 Jul 2007 | 542 |
| 16 | AMNESIA William G. J. Halfond, Alessandro Orso | 7 Nov 2005 | 530 |
| 17 | The essence of command injection attacks in web applications Zhendong Su, Gary Wassermann | 11 Jan 2006 | 519 |
| 18 | MulVAL: a logic-based network security analyzer Xinming Ou, Sudhakar Govindavajhala, Andrew W. Appel | 31 Jul 2005 | 512 |
| 19 | Cybersecurity in healthcare: A systematic review of modern threats and trends Clemens Scott Kruse, Benjamin Frederick, Taylor Jacobson et al. · Technology and Health Care | 27 Sep 2016 | 483 |
| 20 | Cross Site Scripting Prevention with Dynamic Data Tainting and Static Analysis. Philipp Vogt, Florian Nentwich, Nenad M. Jovanovic et al. · Network and Distributed System Security Symposium | 2007 | 483 |
| 21 | Improving security using extensible lightweight static analysis David Evans, David Larochelle · IEEE Software | 2002 | 472 |
| 22 | Permission re-delegation: attacks and defenses Adrienne Porter Felt, Helen J. Wang, Alexander Moshchuk et al. | 8 Aug 2011 | 465 |
| 23 | A Symbolic Execution Framework for JavaScript Prateek Saxena, Devdatta Akhawe, Steve Hanna et al. | 2010 | 457 |
| 24 | SQLrand: Preventing SQL Injection Attacks Stephen Boyd, Angelos D. Keromytis · Lecture notes in computer science | 2004 | 434 |
| 25 | Predicting vulnerable software components Stephan Neuhaus, Thomas Zimmermann, Christian Holler et al. | 28 Oct 2007 | 420 |
| 26 | Robust defenses for cross-site request forgery Adam Barth, Collin Jackson, John C. Mitchell | 27 Oct 2008 | 419 |
| 27 | Automatically Hardening Web Applications Using Precise Tainting Anh Nguyen‐Tuong, Salvatore Guarnieri, Doug Greene et al. · IFIP advances in information and communication technology | 2005 | 390 |
| 28 | Using parse tree validation to prevent SQL injection attacks Gregory Buehrer, Bruce W. Weide, Paolo A. G. Sivilotti | 5 Sep 2005 | 389 |
| 29 | Static detection of cross-site scripting vulnerabilities Gary Wassermann, Zhendong Su | 10 May 2008 | 388 |
| 30 | Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications Davide Balzarotti, Marco Cova, Vika Felmetsger et al. · Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and Privacy | May 2008 | 386 |
| 31 | Static detection of security vulnerabilities in scripting languages Yichen Xie, Alex Aiken | 31 Jul 2006 | 370 |
| 32 | Polyglot Juan Caballero, Heng Yin, Zhenkai Liang et al. | 28 Oct 2007 | 369 |
| 33 | An analysis of the dynamic behavior of JavaScript programs Gregor Richards, Sylvain Lebresne, Brian R. Burg et al. | 5 Jun 2010 | 359 |
| 34 | Detecting format string vulnerabilities with type qualifiers Umesh Shankar, Kunal Talwar, Jeffrey S. Foster et al. | 13 Aug 2001 | 358 |
| 35 | Sound and precise analysis of web applications for injection vulnerabilities Gary Wassermann, Zhendong Su | 10 Jun 2007 | 356 |
| 36 | Automatic creation of SQL Injection and cross-site scripting attacks Adam Kieyzun, Philip J. Guo, Karthick Jayaraman et al. | 2009 | 344 |
| 37 | Cloud computing adoption framework: A security framework for business clouds Victor I. C. Chang, Yen‐Hung Kuo, Muthu Ramachandran · Future Generation Computer Systems | 23 Oct 2015 | 341 |
| 38 | Taint-enhanced policy enforcement: a practical approach to defeat a wide range of attacks Wei Xu, Sandeep Bhatkar, Ramnath Sekar | 31 Jul 2006 | 338 |
| 39 | Data extraction and label assignment for web databases Jiying Wang, Frederick H. Lochovsky | 2003 | 335 |
| 40 | DynaMine Benjamin Livshits, Thomas Zimmermann | Sep 2005 | 333 |
| 41 | State of the Art: Automated Black-Box Web Application Vulnerability Testing Jason Bau, Elie Bursztein, Divij Gupta et al. | 2010 | 321 |
| 42 | TAJ Omer Tripp, Marco Pistoia, Stephen J. Fink et al. | 15 Jun 2009 | 310 |
| 43 | Raksha MICHAEL G. DALTON, Hari Kannan, Christos Kozyrakis | 9 Jun 2007 | 303 |
| 44 | Defending Against Injection Attacks Through Context-Sensitive String Evaluation Tadeusz Pietraszek, Chris Vanden Berghe · Lecture notes in computer science | 2006 | 303 |
| 45 | Noxes Engin Kirda, Christopher Kruegel, Giovanni Vigna et al. | 23 Apr 2006 | 294 |
| 46 | A Learning-Based Approach to the Detection of SQL Attacks Fredrik Valeur, Darren Mutz, Giovanni Vigna · Lecture notes in computer science | 2005 | 285 |
| 47 | Defeating script injection attacks with browser-enforced embedded policies Trevor Jim, Nikhil Swamy, Michael Hicks | 8 May 2007 | 282 |
| 48 | You are what you include Nick Nikiforakis, Luca Invernizzi, Alexandros Kapravelos et al. | 15 Oct 2012 | 280 |
| 49 | Jalangi: a selective record-replay and dynamic analysis framework for JavaScript Koushik Sen, Swaroop Kalasapur, Tasneem G. Brutch et al. | 18 Aug 2013 | 273 |
| 50 | CVEfixes: automated collection of vulnerabilities and their fixes from open-source software Guru Prasad Bhandari, Amara Naseer, Leon Moonen | 18 Aug 2021 | 264 |
Citations are OpenAlex's own counts, from its 2026-09-23 snapshot, so the ranking can differ from Google Scholar or Web of Science. A paper is listed for a field when OpenAlex files it under one of the field's topics; retracted papers and papers whose citation count cannot be traced to citing works are left out, and a preprint and the article it became are shown once. Release dates are OpenAlex's: where a source gave only a month or a year, that is what is shown. How the lists are chosen.