TAP

TAP identifies vulnerabilities in PHP web applications using a PHP-specific tokenization mechanism combined with word2vec embeddings and LSTM deep learning for static source-code analysis.

Key Features:

• Token Mechanism: A custom PHP tokenizer that unifies tokens, supports PHP-specific language features, and implements parameter iteration to enable data-flow analysis within source code.
• Deep Learning Integration: Token sequences are encoded with word2vec and classified by an LSTM network trained on the Software Assurance Reference Dataset (SARD) and SQLI-LABS.
• Performance Metrics: Experimental evaluation on the CWE-89 dataset reported AUC 0.9941 and accuracy 0.9787; in multiclass classification it reported Kappa 0.8319 and hamming distance 0.0840 and outperformed RIPS.

Scientific Applications:

• Vulnerability detection in PHP: Automated identification of vulnerabilities in PHP source code using token-based static analysis and deep learning.
• Software assurance research: Training and benchmarking vulnerability-detection models using datasets such as SARD and SQLI-LABS.
• Comparative evaluation of static analyzers: Quantitative comparison of detection performance against existing tools such as RIPS using AUC, accuracy, Kappa, and hamming distance.

Methodology:

Design of a PHP-specific tokenizer with parameter iteration for data-flow analysis; token sequences embedded by word2vec and processed by LSTM networks; models trained on SARD and SQLI-LABS and evaluated on the CWE-89 dataset including multiclass comparisons to RIPS.