Processing Web Applications Using NLP for Vulnerability Identification

Web applications are widely used to access and manage services, including databases to store and retrieve data. However, these applications have suffered from vulnerability issues in their source code, which represents a serious threat to information protection, such as the exploitation of the SQL injection vulnerability that allows access unduly to data from databases. This paper addresses the web vulnerability problem by using Natural Language Processing (NLP) models to detect vulnerabilities in an Intermediate Language (IL) representation of web application source code. The focus on using an IL is to represent the code in a generic language that can be used to train different NLP models, such as sequential (e.g. Hidden Markov Models) and neural network (e.g. Transformers), with the goal of detecting vulnerabilities in several manners and explaining their existence. A vulnerability detection tool will combine these models to check if the code is absent of vulnerabilities or not, stating where they are posed in the code. Preliminary results show that neural network models are able to interpret IL code as being original code and detect vulnerabilities through it.