Due to more customer data going online by adapting to online banking or fund transfer practices, users’ accounts and other information have become vulnerable to fraud and other attacks. Also, hackers in recent years are increasingly targeting web applications, since most networks are closely monitored through Intrusion Detec- tion Systems (IDS) and firewalls. Therefore, the web application layer needs to be secured from unauthorized users by building across the software development lifecycle security mechanism [1] . This ensures that it is not an afterthought issue, only considered in the end [2] as in many software development processes, where as a result, attackers continue to explore areas of vulnerability to undermine the integrity of applications. In recog- nition of this problem, developers have to incorporate security during the development in order to produce vulnerability free software systems, since the existence of flaws at the design or coding phase of the deve- lopment lifecycle can open web applications to a wide range of attacks [3] .

However, many studies have been conducted by both practitioners and researchers on the mechanism of building security in web applications, but few studies have been carried out on security development models that guide the development process [4] .

Therefore, there is a need to investigate the available development phases of software lifecycle, as well as the security mechanism, to determine what the most appropriate approach or technique is for securing the web applications layer, and for what vulnerability. This SLR uses [5] guidelines to investigate the different studies available on security development models within the web application layer. Details addressed include the approach or technique used, the vulnerability addressed and the stage in the development life cycle where the approach or technique is emphasized.

The SLR attempts to answer the question of what the most security vulnerability harm the web application. It also addresses the question of under what circumstance the security approach or technique is most efficient in addressing the inherent vulnerabilities. Section 2 describes in detail what a systematic literature review is all about and the procedure followed by this review. Section 3 describes the result obtained from the review and Section 4 discusses the results of Section 3 and makes recommendations.

Some of the previous systematic literature review such as “Empirical Analysis of System-Level Vulnerability Metrics through Actual Attacks” [6] has highlighted the benefits, shortcomings and strengths of agile methods. It has further explored the implication of the review as imitating a need for better empirical study of agile software development. The review has neither strictly covered the aspect of security surrounding the vulnerability detection method, nor has it addressed the circumstances where the development tool is efficient with regard to security mitigation.

Also, another literature review conducted by [7] , they have stressed on security requirement engineering. The review chooses studies that have assimilated security only at the requirement stage of information system construction without paying much attention to security across the development lifecycle.

All the reviews mentioned has not sufficiently address the issue of building security across the entire lifecycle of web application security development.

Similarly, there other systematic reviews conducted on other aspects of web applications area which has no association with the current systematic review on building security in development lifecycle. For instance, [8] conducted systematic review to identify and discuss the existing vulnerabilities and tools used by small and medium web companies and to propose new software vulnerability detection methods in order to measure the company’s success. Also Blanco et al. used systematic view to identify, extract and analyze the main plans for security ontologies. None of these reviews have addressed the question of the most appropriate security tools and techniques for mitigating vulnerability in the web applications.

The construction of this review is based on kitchenham guiding principle [9] , while also being channeled by other systematic literature review articles in the area of software development, such as [10] and [11] . A wide- ranging search is carried out into a number of respected science sources, i.e. the IEEE Computer Society, ACM Digital Library, Google Scholar, Science Direct, and Springer Link. A total of 623 published papers in the domain were extracted. After a careful synthesis, and based on inclusion or exclusion criteria, 56 papers that are primarily centered on security in the web application vulnerabilities were considered. Hence a thorough picture of the state of the art in different web application vulnerabilities security approaches is investigated, and other issues surrounding the research question are also brought to light with worthwhile directions for future investigations.

This section shows how the review process was conducted including activities such as question formularization, source selection, study selection process, information extraction and extraction execution.

Based on the (Kitchenham 2007) guidelines for systematic literature reviews, research questions are the most important aspect of review since they guide the entire process by ensuring that primary study selection and aggregation relate directly to the question. Therefore, asking the appropriate questions is critical to finding an appropriate research dimension in SLR. Hence this review has drawn up the research question thus: “Researchers have employed which methods to detect security vulnerabilities of web application”.

The research question follows the PICO paradigm mentioned in the (Kitchenham 2007) guideline for SLR.

Population: It is consist on set of studies and articles indicating the empirical studies for detection of the security vulnerabilities of web applications.

Intervention: Solutions mentioned in the studies for detecting security vulnerabilities of web applications.

Outcome: Measure and form of evidence linked to the detection of security vulnerabilities in web applications.

Context: Covering the domain of web applications focusing on empirical studies.

The above question is further refined to the following important questions:

RQ1. What are the methods adopted by researchers and practitioners in order to detect web application security vulnerabilities.

The research question RQ1. Is enhanced into following sub questions?

1) Enlist and elaborate the stage(s) of web application in which the vulnerability detection methods (VDMs) are functional.

The aim of this question is to highlight the phases of web development process in which VDMs are applied in number of times, what kind of web security vulnerabilities that are extracted during the web development stages are analyzed, and in what way these methods are combined during the process of web development.

2) Which web application vulnerability(es) have been frequently detected during empirical analysis?

During the analysis different security vulnerabilities are described which affect the web application severely and occur frequently while some are not very common and not occur so many times. The aim of this research is to detect most severe and dangerous vulnerabilities in web applications.

3) Enlist data characteristics used for web application security vulnerabilities detection?

This question will answer about single, cross-company and student/commercial projects data sets used for evaluation.

RQ2. Can OWASP Top 10 help to categories these vulnerabilities?

The OWASP Top 10 is widely used by the researchers in case of web application vulnerabilities detection. There is broad consensus regarding OWASP Top 10 for detection of most critical web application vulnerabilities. It is consulted in all over the world by the security experts to contribute in OWASP Top 10 [5] -[7] [9] , and [12] .

The research question RQ1 is expected to identify the different techniques used by researchers or practitioners when developing secure web applications. These tools and techniques could be well-known software engineering tools with built-in security, or a new security paradigm purposely designed for web application security development.

Similarly, research question RQ2 is expected to identify the most of the vulnerabilities that are detected within the security development lifecycle, such as Cross site scripting, SQL Injection and Insecure direct object.

In the way to identify as many primary studies as possible that are related to these research questions, the study carried a pilot search on some trustworthy database sources. A pilot search on these sources has discovered that some similar publications are indexed in two different sources, and therefore, the search selection is limited to the following database sources:

・ IEEE Explorer;

・ ACM Digital Library;

・ Springer Link;

・ Science Direct.

At first the search keywords were extracted from Population, Intervention, Context and Outcome paradigm (PICO), as claimed in the earlier section. After a steer assessment, the recommended keywords from the sources were combined to the list of keywords during live-run searches.

Table 1 shows the primary strongly matched search keywords based on the following derivation:

・ Population: web application;

・ Intervention: security vulnerability;

・ Context: domain of web applications;

・ Outcome: quantity and type appropriate vulnerability.

Therefore, keywords are concatenated using Boolean “AND” and “OR” to come up with various query strings such as those shown in Table 2.

In the search keyword combination using “AND” and “OR” even though a sole query string might construct higher results in a particular data source than other sources, the query string that created the on the whole best result was:

“Web AND security AND web development OR web development vulnerabilities OR development procedure OR software lifecycle”.

The search results were purified based on applicability to the search keyword since the date of publication is irrelevant to the research questions.

Before the extraction of articles from the identified sources was done, the method of inclusion and exclusion of articles based on the research questions was explained. The following are the criteria used in excluding or including a publication:

Initial selection for inclusion was based on whether the article title, abstract or introduction has a clear connection with the study.

The second stage excluded all articles that do not consider security issues in the software development, since the major concern of this study is security vulnerabilities.

The third stage excluded those articles that, although security related, do not directly involve the web application layer. The articles in this case might be related to security on web services such as browsers, mash ups, and other services.

The fourth and final stage included all primary studies related to the two research questions.

The first author of this study applied the inclusion/exclusion criteria to the publications regained using the search keywords. The second author used a quantitative valuation.

Checklist to assess the quality of the individual publication.

There are three major categories of primary studies identified from the extracted publications:

・ Studies involving validation methods;

・ Studies involving development stages or a lifecycle where security is emphasized;

・ Studies involving security tools and mechanisms for detecting vulnerabilities.

Table 7 shows the various methods and strategies used to validate the given studies. The graphical representation of Table 7 is also shown in Figure 1. Similarly, Table 8 shows the category of studies that consider security at various development phases [13] .

Some of the studies consider placing security checks during requirements and design, while others consider the security checks through implementation and testing phase.

Table 9 depicts the security vulnerabilities identified by the OWASP Top 10 during software development. These Top 10 vulnerabilities are documented in the list of OWASP Top 10. Figure 2 is also representing the percentage of listed vulnerabilities. Table 10 indicates the data characteristics from different fields, the tools used to assess vulnerabilities and the mechanism used such as code vulnerability analysis, run-time check and others

are depicted in Table 10.

This section is intended to discuss and analyze the result presented in the previous section and provide significant suggestions that may lead to an in-depth understanding of the domain.

Therefore, our discussion is based on the following result.

We want to pay special thanks to Ms. Mamoona Humayun for her supporting role in conducting this research work and spent her precious time to help as a supervisor. We also thank anonymous reviewers who gave us very valuable feedback to improve this work.

SajjadRafique,MamoonaHumayun,ZartashaGul,AnsarAbbas,HasanJaved, (2015) Systematic Review of Web Application Security Vulnerabilities Detection Methods. Journal of Computer and Communications,03,28-40. doi: 10.4236/jcc.2015.39004