<?xml version="1.0" encoding="ISO-8859-1"?><article xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<front>
<journal-meta>
<journal-id>1390-7697</journal-id>
<journal-title><![CDATA[Revista Científica y Tecnológica UPSE (RCTU)]]></journal-title>
<abbrev-journal-title><![CDATA[RCTU]]></abbrev-journal-title>
<issn>1390-7697</issn>
<publisher>
<publisher-name><![CDATA[Universidad Estatal Península de Santa Elena]]></publisher-name>
</publisher>
</journal-meta>
<article-meta>
<article-id>S1390-76972024000200130</article-id>
<article-id pub-id-type="doi">10.26423/rctu.v11i2.800</article-id>
<title-group>
<article-title xml:lang="es"><![CDATA[Modelos de Pruebas de Seguridad Estática en Reducción de Ineficiencia identificación de Inyección SQL en Aplicaciones Web]]></article-title>
<article-title xml:lang="en"><![CDATA[Static Security Testing Models in Inefficiency Reduction Identification of SQL Injection in Web Applications]]></article-title>
</title-group>
<contrib-group>
<contrib contrib-type="author">
<name>
<surname><![CDATA[Tipacti Garcia]]></surname>
<given-names><![CDATA[Armando]]></given-names>
</name>
<xref ref-type="aff" rid="Aff"/>
</contrib>
</contrib-group>
<aff id="Af1">
<institution><![CDATA[,Universidad Nacional Mayor de San Marcos  ]]></institution>
<addr-line><![CDATA[Lima ]]></addr-line>
<country>Peru</country>
</aff>
<pub-date pub-type="pub">
<day>00</day>
<month>12</month>
<year>2024</year>
</pub-date>
<pub-date pub-type="epub">
<day>00</day>
<month>12</month>
<year>2024</year>
</pub-date>
<volume>11</volume>
<numero>2</numero>
<fpage>130</fpage>
<lpage>144</lpage>
<copyright-statement/>
<copyright-year/>
<self-uri xlink:href="http://scielo.senescyt.gob.ec/scielo.php?script=sci_arttext&amp;pid=S1390-76972024000200130&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://scielo.senescyt.gob.ec/scielo.php?script=sci_abstract&amp;pid=S1390-76972024000200130&amp;lng=en&amp;nrm=iso"></self-uri><self-uri xlink:href="http://scielo.senescyt.gob.ec/scielo.php?script=sci_pdf&amp;pid=S1390-76972024000200130&amp;lng=en&amp;nrm=iso"></self-uri><abstract abstract-type="short" xml:lang="es"><p><![CDATA[RESUMEN La detección temprana de vulnerabilidades es crucial en el desarrollo de software para garantizar la seguridad de las aplicaciones web, especialmente frente a ataques de inyección SQL. Las pruebas de Seguridad Estática (SAST) permiten identificar vulnerabilidades desde las primeras etapas del ciclo de vida del desarrollo. Este artículo revisa sistemáticamente la literatura para identificar y analizar los modelos de SAST más eficaces en reducir ineficiencias en la detección de inyecciones SQL. Siguiendo las guías PRISMA 2020 y el enfoque de Kitchenham, se realizaron búsquedas exhaustivas en bases de datos como EBSCO y Scopus. Los resultados muestran que la integración temprana de SAST y el uso de inteligencia artificial mejoran la detección de vulnerabilidades, reduciendo falsos positivos y negativos. La implementación de modelos avanzados de SAST es esencial para mejorar la seguridad de las aplicaciones web, sugiriéndose investigaciones futuras en metodologías más integradas y nuevas herramientas.]]></p></abstract>
<abstract abstract-type="short" xml:lang="en"><p><![CDATA[ABSTRACT Early detection of vulnerabilities is crucial in software development to ensure the security of web applications, especially against SQL injection attacks. Static Application Security Testing (SAST) allows for the identification of vulnerabilities from the early stages of the development lifecycle. This article systematically reviews the literature to identify and analyze the most effective SAST models in reducing inefficiencies in detecting SQL injections. Following PRISMA 2020 guidelines and Kitchenham&#8217;s approach, exhaustive searches were conducted in databases like EBSCO and Scopus. The results show that early integration of SAST and the use of artificial intelligence significantly improve vulnerability detection, reducing false positives and negatives. The implementation of advanced SAST models is essential for enhancing the security of web applications, with future research suggested to explore more integrated methodologies and new tools.]]></p></abstract>
<kwd-group>
<kwd lng="es"><![CDATA[Pruebas Seguridad Estática]]></kwd>
<kwd lng="es"><![CDATA[Desarrollo de Software Seguro]]></kwd>
<kwd lng="es"><![CDATA[DevSecOps]]></kwd>
<kwd lng="es"><![CDATA[Inyección SQL.]]></kwd>
<kwd lng="en"><![CDATA[Static application security testing]]></kwd>
<kwd lng="en"><![CDATA[Secure software development]]></kwd>
<kwd lng="en"><![CDATA[DevSecOps]]></kwd>
<kwd lng="en"><![CDATA[SQL Inyection.]]></kwd>
</kwd-group>
</article-meta>
</front><back>
<ref-list>
<ref id="B1">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[False Alarm Reduction Method for Weakness Static Analysis Using BERT Model.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[NGUYEN]]></surname>
<given-names><![CDATA[Dinh]]></given-names>
</name>
<name>
<surname><![CDATA[SEO]]></surname>
<given-names><![CDATA[Aria]]></given-names>
</name>
<name>
<surname><![CDATA[NNAMDI]]></surname>
<given-names><![CDATA[Nnubia]]></given-names>
</name>
<name>
<surname><![CDATA[SON]]></surname>
<given-names><![CDATA[Yunsik.]]></given-names>
</name>
</person-group>
<source><![CDATA[Applied Sciences]]></source>
<year>2023</year>
<volume>13</volume>
<numero>6</numero>
<issue>6</issue>
<page-range>1-13</page-range></nlm-citation>
</ref>
<ref id="B2">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Secure software development and testing: A model-based methodology]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[CASOLA]]></surname>
<given-names><![CDATA[Valentina]]></given-names>
</name>
<name>
<surname><![CDATA[DE BENEDICTIS]]></surname>
<given-names><![CDATA[Alessandra]]></given-names>
</name>
<name>
<surname><![CDATA[MAZZOCCA]]></surname>
<given-names><![CDATA[Carlo]]></given-names>
</name>
<name>
<surname><![CDATA[ORBINATO]]></surname>
<given-names><![CDATA[Vittorio.]]></given-names>
</name>
</person-group>
<source><![CDATA[: Computers &amp; Security]]></source>
<year>2024</year>
<volume>137</volume>
<page-range>1-16</page-range></nlm-citation>
</ref>
<ref id="B3">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Advancing Static Code Analysis with Language-Agnostic Component Identification.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SCHIEWE]]></surname>
<given-names><![CDATA[Micah]]></given-names>
</name>
<name>
<surname><![CDATA[CURTIS]]></surname>
<given-names><![CDATA[Jacob]]></given-names>
</name>
<name>
<surname><![CDATA[BUSHONG]]></surname>
<given-names><![CDATA[Vincent]]></given-names>
</name>
<name>
<surname><![CDATA[CERNY]]></surname>
<given-names><![CDATA[Tomas.]]></given-names>
</name>
</person-group>
<source><![CDATA[IEEE Access]]></source>
<year>2022</year>
<volume>10</volume>
<page-range>30743-61</page-range></nlm-citation>
</ref>
<ref id="B4">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[A security specific knowledge modelling approach for secure software engineering.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[ABEYRATHNA]]></surname>
<given-names><![CDATA[Ashanthi]]></given-names>
</name>
<name>
<surname><![CDATA[SAMARAGE]]></surname>
<given-names><![CDATA[Chamal]]></given-names>
</name>
<name>
<surname><![CDATA[DAHANAYAKE]]></surname>
<given-names><![CDATA[Buddika]]></given-names>
</name>
<name>
<surname><![CDATA[WIJESIRIWARDANA]]></surname>
<given-names><![CDATA[Chaman]]></given-names>
</name>
<name>
<surname><![CDATA[Wimalaratne]]></surname>
<given-names><![CDATA[Prasad.]]></given-names>
</name>
</person-group>
<source><![CDATA[Journal of the National Science Foundation of Sri Lanka]]></source>
<year>2020</year>
<volume>48</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>93-8</page-range></nlm-citation>
</ref>
<ref id="B5">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[On Combining Static, Dynamic and Interactive Analysis Security Testing Tools to Improve OWASP Top Ten Security Vulnerability Detection in Web Applications.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[MATEO]]></surname>
<given-names><![CDATA[Francesc]]></given-names>
</name>
<name>
<surname><![CDATA[BERMEJO]]></surname>
<given-names><![CDATA[Juan]]></given-names>
</name>
<name>
<surname><![CDATA[BERMEJO]]></surname>
<given-names><![CDATA[Javier]]></given-names>
</name>
<name>
<surname><![CDATA[SICILIA]]></surname>
<given-names><![CDATA[Juan]]></given-names>
</name>
<name>
<surname><![CDATA[ARGYROS]]></surname>
<given-names><![CDATA[Michael]]></given-names>
</name>
</person-group>
<source><![CDATA[Applied Sciences]]></source>
<year>2020</year>
<volume>10</volume>
<numero>24</numero>
<issue>24</issue>
<page-range>1-26</page-range></nlm-citation>
</ref>
<ref id="B6">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Using ChatGPT as a Static Application Security Testing Tool.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[BAKHSHANDEH]]></surname>
<given-names><![CDATA[Atieh]]></given-names>
</name>
<name>
<surname><![CDATA[KERAMATFAR]]></surname>
<given-names><![CDATA[Abdalsamad]]></given-names>
</name>
<name>
<surname><![CDATA[NOROUZI]]></surname>
<given-names><![CDATA[Amir]]></given-names>
</name>
<name>
<surname><![CDATA[CHEKIDEHKHOUN]]></surname>
<given-names><![CDATA[Mohammad]]></given-names>
</name>
</person-group>
<source><![CDATA[The ISC International Journal of Information Security]]></source>
<year>2023</year>
<volume>15</volume>
<numero>3</numero>
<issue>3</issue>
<page-range>1-8</page-range></nlm-citation>
</ref>
<ref id="B7">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Software Engineering Secure CodeCity: 3-dimensional visualization of software security facets]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[WIJESIRIWARDANA]]></surname>
<given-names><![CDATA[C.]]></given-names>
</name>
<name>
<surname><![CDATA[WIMALARATNE]]></surname>
<given-names><![CDATA[P.]]></given-names>
</name>
<name>
<surname><![CDATA[ABEYSINGHE]]></surname>
<given-names><![CDATA[T.]]></given-names>
</name>
<name>
<surname><![CDATA[SHALIKA S.]]></surname>
<given-names><![CDATA[N.]]></given-names>
</name>
<name>
<surname><![CDATA[MUFARRIJ]]></surname>
<given-names><![CDATA[M.]]></given-names>
</name>
</person-group>
<source><![CDATA[Journal of the National Science Foundation of Sri Lanka]]></source>
<year>2023</year>
<volume>51</volume>
<numero>3</numero>
<issue>3</issue>
<page-range>423-36</page-range></nlm-citation>
</ref>
<ref id="B8">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Combinatorial Method with Static Analysis for Source Code Security in Web Applications]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[BERMEJO]]></surname>
<given-names><![CDATA[Juan]]></given-names>
</name>
<name>
<surname><![CDATA[BERMEJO]]></surname>
<given-names><![CDATA[Javier]]></given-names>
</name>
<name>
<surname><![CDATA[SICILIA]]></surname>
<given-names><![CDATA[Juan]]></given-names>
</name>
<name>
<surname><![CDATA[SUREDA]]></surname>
<given-names><![CDATA[Tomás]]></given-names>
</name>
<name>
<surname><![CDATA[ARGYROS]]></surname>
<given-names><![CDATA[Christopher]]></given-names>
</name>
<name>
<surname><![CDATA[MAGREÑÁN]]></surname>
<given-names><![CDATA[Alberto]]></given-names>
</name>
</person-group>
<source><![CDATA[Computer Modeling in Engineering &amp; Sciences]]></source>
<year>2021</year>
<volume>129</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>541-65</page-range></nlm-citation>
</ref>
<ref id="B9">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[The PRISMA 2020 statement: An updated guideline for reporting systematic reviews.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[PAGE]]></surname>
<given-names><![CDATA[Matthew]]></given-names>
</name>
<name>
<surname><![CDATA[MCKENZIE]]></surname>
<given-names><![CDATA[Joanne]]></given-names>
</name>
<name>
<surname><![CDATA[BOSSUYT]]></surname>
<given-names><![CDATA[Patrick]]></given-names>
</name>
<name>
<surname><![CDATA[BOUTRON]]></surname>
<given-names><![CDATA[Isabelle]]></given-names>
</name>
<name>
<surname><![CDATA[HOFFMANN]]></surname>
<given-names><![CDATA[Tammy]]></given-names>
</name>
<name>
<surname><![CDATA[MULROW]]></surname>
<given-names><![CDATA[Cynthia]]></given-names>
</name>
</person-group>
<source><![CDATA[BMJ Journals]]></source>
<year>2021</year>
<volume>372</volume>
<page-range>1-9</page-range></nlm-citation>
</ref>
<ref id="B10">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Procedures for Performing Systematic Reviews.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[KITCHENHAM]]></surname>
<given-names><![CDATA[Barbara.]]></given-names>
</name>
</person-group>
<source><![CDATA[Keele University Technical Report,]]></source>
<year>2004</year>
<page-range>1-28</page-range></nlm-citation>
</ref>
<ref id="B11">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Gamificación en la enseñanza de las matemáticas: una revisión sistemática.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[HOLGUIN]]></surname>
<given-names><![CDATA[Fresia]]></given-names>
</name>
<name>
<surname><![CDATA[HOLGUIN]]></surname>
<given-names><![CDATA[Edys]]></given-names>
</name>
<name>
<surname><![CDATA[GARCIA]]></surname>
<given-names><![CDATA[Nelly.]]></given-names>
</name>
</person-group>
<source><![CDATA[Revista de Estudios Interdisciplinarios en Ciencias Sociales]]></source>
<year>2020</year>
<volume>22</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>62-75</page-range></nlm-citation>
</ref>
<ref id="B12">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[From DevOps to DevSecOps is not enough. CyberDevOps: an extreme shifting-left architecture to bring cybersecurity within software security lifecycle pipeline.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[LOMBARDI]]></surname>
<given-names><![CDATA[Francisco]]></given-names>
</name>
<name>
<surname><![CDATA[FANTON]]></surname>
<given-names><![CDATA[Alberto]]></given-names>
</name>
</person-group>
<source><![CDATA[Software Quality Journal]]></source>
<year>2023</year>
<volume>31</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>619-54</page-range></nlm-citation>
</ref>
<ref id="B13">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Microservices-based DevSecOps Platform using Pipeline and Open Source Software]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[LEE]]></surname>
<given-names><![CDATA[Wen]]></given-names>
</name>
<name>
<surname><![CDATA[LIU]]></surname>
<given-names><![CDATA[Zhun]]></given-names>
</name>
</person-group>
<source><![CDATA[Journal of Information Science and Engineering]]></source>
<year>2023</year>
<volume>39</volume>
<numero>5</numero>
<issue>5</issue>
</nlm-citation>
</ref>
<ref id="B14">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Secure Software Engineering: A Knowledge Modeling based Approach for Inferring Association between Source Code and Design Artifacts.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[WIJESIRIWARDANA]]></surname>
<given-names><![CDATA[Chaman]]></given-names>
</name>
<name>
<surname><![CDATA[ABEYRATNE]]></surname>
<given-names><![CDATA[Ashanthi]]></given-names>
</name>
<name>
<surname><![CDATA[SAMARAGE]]></surname>
<given-names><![CDATA[Chamal]]></given-names>
</name>
<name>
<surname><![CDATA[DAHANAYAKE]]></surname>
<given-names><![CDATA[Buddika]]></given-names>
</name>
<name>
<surname><![CDATA[WIMALARATNE]]></surname>
<given-names><![CDATA[Prasad.]]></given-names>
</name>
</person-group>
<source><![CDATA[International Journal of Advanced Computer Science and Applications]]></source>
<year>2020</year>
<volume>11</volume>
<numero>12</numero>
<issue>12</issue>
<page-range>708-16</page-range></nlm-citation>
</ref>
<ref id="B15">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Static data-flow analysis for software product lines in C.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SCHUBERT]]></surname>
<given-names><![CDATA[Philipp]]></given-names>
</name>
<name>
<surname><![CDATA[GAZZILLO]]></surname>
<given-names><![CDATA[Paul]]></given-names>
</name>
<name>
<surname><![CDATA[PATTERSON]]></surname>
<given-names><![CDATA[Zach]]></given-names>
</name>
<name>
<surname><![CDATA[BRAHA]]></surname>
<given-names><![CDATA[Julian]]></given-names>
</name>
<name>
<surname><![CDATA[SCHIEBEL]]></surname>
<given-names><![CDATA[Fabian]]></given-names>
</name>
<name>
<surname><![CDATA[HERMANN]]></surname>
<given-names><![CDATA[Ben]]></given-names>
</name>
<name>
<surname><![CDATA[WEI]]></surname>
<given-names><![CDATA[Shiyi]]></given-names>
</name>
<name>
<surname><![CDATA[BODDEN]]></surname>
<given-names><![CDATA[Eric.]]></given-names>
</name>
</person-group>
<source><![CDATA[Automated Software Engineering]]></source>
<year>2022</year>
<volume>29</volume>
<numero>35</numero>
<issue>35</issue>
<page-range>1-37</page-range></nlm-citation>
</ref>
<ref id="B16">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Can the conFiguration of static analyses make resolving security vulnerabilities more effective? - A user study.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[PISKACHEV]]></surname>
<given-names><![CDATA[Goran]]></given-names>
</name>
<name>
<surname><![CDATA[BECKER]]></surname>
<given-names><![CDATA[Matthias]]></given-names>
</name>
<name>
<surname><![CDATA[BODDEN]]></surname>
<given-names><![CDATA[Erick.]]></given-names>
</name>
</person-group>
<source><![CDATA[Empirical Software Engineering]]></source>
<year>2023</year>
<volume>28</volume>
<numero>118</numero>
<issue>118</issue>
<page-range>1-28</page-range></nlm-citation>
</ref>
<ref id="B17">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Comprehensive Evaluation of Static Analysis Tools for Their Performance in Finding Vulnerabilities in Java Code.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[ALQARADAGHI]]></surname>
<given-names><![CDATA[Midya]]></given-names>
</name>
<name>
<surname><![CDATA[KOZSIK]]></surname>
<given-names><![CDATA[Tamás.]]></given-names>
</name>
</person-group>
<source><![CDATA[IEEE Access]]></source>
<year>2024</year>
<volume>12</volume>
<page-range>55824-42</page-range></nlm-citation>
</ref>
<ref id="B18">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Model to reduce DevOps Pipeline execution time using SAST]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SAURABH]]></surname>
<given-names><![CDATA[Shobhit]]></given-names>
</name>
<name>
<surname><![CDATA[KUMAR]]></surname>
<given-names><![CDATA[Deepak.]]></given-names>
</name>
</person-group>
<source><![CDATA[International Journal of System Assurance Engineering and Management]]></source>
<year>2024</year>
<volume>15</volume>
<page-range>1999-2009</page-range></nlm-citation>
</ref>
<ref id="B19">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[YUAN]]></surname>
<given-names><![CDATA[Ye]]></given-names>
</name>
<name>
<surname><![CDATA[LU]]></surname>
<given-names><![CDATA[Yuliang]]></given-names>
</name>
<name>
<surname><![CDATA[ZHU]]></surname>
<given-names><![CDATA[Kailong]]></given-names>
</name>
<name>
<surname><![CDATA[HUANG]]></surname>
<given-names><![CDATA[Hui]]></given-names>
</name>
<name>
<surname><![CDATA[YU]]></surname>
<given-names><![CDATA[Lu]]></given-names>
</name>
<name>
<surname><![CDATA[ZHAO]]></surname>
<given-names><![CDATA[Jiazhen]]></given-names>
</name>
</person-group>
<source><![CDATA[Applied Sciences]]></source>
<year>2023</year>
<volume>13</volume>
<numero>21</numero>
<issue>21</issue>
<page-range>1-18</page-range></nlm-citation>
</ref>
<ref id="B20">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Comparative Analysis of Open-Source Tools for Conducting Static Code Analysis.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[KUSZCZY&#323;SKI]]></surname>
<given-names><![CDATA[Kajetan]]></given-names>
</name>
<name>
<surname><![CDATA[WALKOWSKI]]></surname>
<given-names><![CDATA[Michal.]]></given-names>
</name>
</person-group>
<source><![CDATA[Sensors]]></source>
<year>2023</year>
<volume>23</volume>
<numero>18</numero>
<issue>18</issue>
<page-range>2-33</page-range></nlm-citation>
</ref>
<ref id="B21">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Hybrid security assessment methodology for web applications]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[CORREA]]></surname>
<given-names><![CDATA[Roddy]]></given-names>
</name>
<name>
<surname><![CDATA[BERMEJO]]></surname>
<given-names><![CDATA[Javier]]></given-names>
</name>
<name>
<surname><![CDATA[SICILIA]]></surname>
<given-names><![CDATA[Juan]]></given-names>
</name>
<name>
<surname><![CDATA[SANCHEZ]]></surname>
<given-names><![CDATA[Manuel]]></given-names>
</name>
<name>
<surname><![CDATA[Magreñán]]></surname>
<given-names><![CDATA[Alberto]]></given-names>
</name>
</person-group>
<source><![CDATA[Computer Modeling in Engineering and Sciences]]></source>
<year>2021</year>
<volume>126</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>89-124</page-range></nlm-citation>
</ref>
<ref id="B22">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Context-Aware Software Vulnerability Classification Using Machine Learning.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SIEWRUK]]></surname>
<given-names><![CDATA[Grzegorz]]></given-names>
</name>
<name>
<surname><![CDATA[MAZURCZYK]]></surname>
<given-names><![CDATA[Wojciech.]]></given-names>
</name>
</person-group>
<source><![CDATA[IEEE Access]]></source>
<year>2021</year>
<volume>9</volume>
<page-range>88852-67</page-range></nlm-citation>
</ref>
<ref id="B23">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[A machine and deep learning analysis among SonarQube rules, product, and process metrics for fault prediction]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[LOMIO]]></surname>
<given-names><![CDATA[Francesco]]></given-names>
</name>
<name>
<surname><![CDATA[MORESCHINI]]></surname>
<given-names><![CDATA[Sergio]]></given-names>
</name>
<name>
<surname><![CDATA[LENARDUZZI]]></surname>
<given-names><![CDATA[Valentina]]></given-names>
</name>
</person-group>
<source><![CDATA[Empirical Software Engineering]]></source>
<year>2022</year>
<volume>27</volume>
<numero>189</numero>
<issue>189</issue>
<page-range>1-57</page-range></nlm-citation>
</ref>
<ref id="B24">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Prediction and Correction of Software Defects in Message-Passing Interfaces Using a Static Analysis Tool and Machine Learning]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[AL-JOHANY]]></surname>
<given-names><![CDATA[Norah]]></given-names>
</name>
<name>
<surname><![CDATA[EASSA]]></surname>
<given-names><![CDATA[Fathy]]></given-names>
</name>
<name>
<surname><![CDATA[SHARAF]]></surname>
<given-names><![CDATA[Sanaa]]></given-names>
</name>
<name>
<surname><![CDATA[NOAMAN]]></surname>
<given-names><![CDATA[Amin]]></given-names>
</name>
<name>
<surname><![CDATA[AHMED]]></surname>
<given-names><![CDATA[Assad]]></given-names>
</name>
</person-group>
<source><![CDATA[IEEE Access]]></source>
<year>2023</year>
<volume>11</volume>
<page-range>60668-80</page-range></nlm-citation>
</ref>
<ref id="B25">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[A New Approach to Web Application Security: Utilizing GPT Language Models for Source Code Inspection]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SZABÓ]]></surname>
<given-names><![CDATA[Zoltán]]></given-names>
</name>
<name>
<surname><![CDATA[BILICKI]]></surname>
<given-names><![CDATA[Vilmos]]></given-names>
</name>
</person-group>
<source><![CDATA[Future Internet]]></source>
<year>2023</year>
<volume>15</volume>
<numero>326</numero>
<issue>326</issue>
<page-range>1-27</page-range></nlm-citation>
</ref>
<ref id="B26">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Design and Implement an Accurate Automated Static Analysis Checker to Detect Insecure Use of SecurityManager]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[ALQARADAGHI]]></surname>
<given-names><![CDATA[Midya]]></given-names>
</name>
<name>
<surname><![CDATA[NAZIR]]></surname>
<given-names><![CDATA[Muhammad]]></given-names>
</name>
<name>
<surname><![CDATA[KOZSIK]]></surname>
<given-names><![CDATA[Tamás.]]></given-names>
</name>
</person-group>
<source><![CDATA[Computers]]></source>
<year>2023</year>
<volume>12</volume>
<numero>247</numero>
<issue>247</issue>
<page-range>2-12</page-range></nlm-citation>
</ref>
<ref id="B27">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Vulnerable JavaScript functions detection using stacking of convolutional neural networks]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SHENEAMER]]></surname>
<given-names><![CDATA[Abdullah]]></given-names>
</name>
</person-group>
<source><![CDATA[Computer Science]]></source>
<year>2024</year>
<volume>10</volume>
<page-range>2-38</page-range></nlm-citation>
</ref>
<ref id="B28">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Software vulnerabilities in TensorFlow-based deep learning applications]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[FILUS]]></surname>
<given-names><![CDATA[Katarzyna]]></given-names>
</name>
</person-group>
<source><![CDATA[Computers &amp; Security]]></source>
<year>2023</year>
<volume>124</volume>
<page-range>1-13</page-range></nlm-citation>
</ref>
<ref id="B29">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Bug detection in Java code: An extensive evaluation of static analysis tools using Juliet Test Suites]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[AMANKWAH]]></surname>
<given-names><![CDATA[Richard]]></given-names>
</name>
<name>
<surname><![CDATA[CHEN]]></surname>
<given-names><![CDATA[Jinfu]]></given-names>
</name>
<name>
<surname><![CDATA[SONG]]></surname>
<given-names><![CDATA[Heping]]></given-names>
</name>
<name>
<surname><![CDATA[KUDJO]]></surname>
<given-names><![CDATA[Patrick.]]></given-names>
</name>
</person-group>
<source><![CDATA[Journal of Software Practice and Experience]]></source>
<year>2023</year>
<volume>53</volume>
<numero>5</numero>
<issue>5</issue>
<page-range>1125-43</page-range></nlm-citation>
</ref>
<ref id="B30">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[The impact of feature types, classifiers, and data balancing techniques on software vulnerability prediction models]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[KAYA]]></surname>
<given-names><![CDATA[Aydin]]></given-names>
</name>
<name>
<surname><![CDATA[KECELI]]></surname>
<given-names><![CDATA[Ali]]></given-names>
</name>
<name>
<surname><![CDATA[CATAL]]></surname>
<given-names><![CDATA[Cagatay]]></given-names>
</name>
<name>
<surname><![CDATA[TEKINERDOGAN]]></surname>
<given-names><![CDATA[Bedir.]]></given-names>
</name>
</person-group>
<source><![CDATA[: Journal of Software Evolution and Process]]></source>
<year>2019</year>
<volume>31</volume>
<numero>9</numero>
<issue>9</issue>
<page-range>1-25</page-range></nlm-citation>
</ref>
<ref id="B31">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Analyzing source code vulnerabilities in the D2A dataset with ML ensembles and C-BERT,]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[PUJAR]]></surname>
<given-names><![CDATA[Saurab]]></given-names>
</name>
<name>
<surname><![CDATA[ZHENG]]></surname>
<given-names><![CDATA[Yunhui]]></given-names>
</name>
<name>
<surname><![CDATA[BURATTI]]></surname>
<given-names><![CDATA[Luca]]></given-names>
</name>
<name>
<surname><![CDATA[LEWIS]]></surname>
<given-names><![CDATA[Burn]]></given-names>
</name>
<name>
<surname><![CDATA[CHEN]]></surname>
<given-names><![CDATA[Yunchung]]></given-names>
</name>
<name>
<surname><![CDATA[LAREDO]]></surname>
<given-names><![CDATA[Jim]]></given-names>
</name>
<name>
<surname><![CDATA[MORARI]]></surname>
<given-names><![CDATA[Alessandro]]></given-names>
</name>
<name>
<surname><![CDATA[EPSTEIN]]></surname>
<given-names><![CDATA[Edward]]></given-names>
</name>
<name>
<surname><![CDATA[LIN]]></surname>
<given-names><![CDATA[Tsungnan]]></given-names>
</name>
<name>
<surname><![CDATA[YANG]]></surname>
<given-names><![CDATA[Bo]]></given-names>
</name>
<name>
<surname><![CDATA[SU]]></surname>
<given-names><![CDATA[Zhong]]></given-names>
</name>
</person-group>
<source><![CDATA[Empirical Software Engineering]]></source>
<year>2024</year>
<volume>29</volume>
<numero>48</numero>
<issue>48</issue>
</nlm-citation>
</ref>
<ref id="B32">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[A C# static code analysis tool for mission critical systems,]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SHAHOOR]]></surname>
<given-names><![CDATA[Arooba]]></given-names>
</name>
<name>
<surname><![CDATA[SHAUKAT]]></surname>
<given-names><![CDATA[Rida]]></given-names>
</name>
<name>
<surname><![CDATA[MINHAS]]></surname>
<given-names><![CDATA[Sumaira]]></given-names>
</name>
<name>
<surname><![CDATA[AWAN]]></surname>
<given-names><![CDATA[Hina]]></given-names>
</name>
<name>
<surname><![CDATA[SAGHAR]]></surname>
<given-names><![CDATA[Kashif]]></given-names>
</name>
</person-group>
<source><![CDATA[Advances in Science Technology and Engineering Systems]]></source>
<year>2020</year>
<volume>5</volume>
<numero>6</numero>
<issue>6</issue>
<page-range>561-70</page-range></nlm-citation>
</ref>
<ref id="B33">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Vulnerabilities mapping based on OWASP-SANS: A survey for static application security testing (SAST).]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[LI]]></surname>
<given-names><![CDATA[Jinfeng.]]></given-names>
</name>
</person-group>
<source><![CDATA[Annals of Emerging Technologies in Computing]]></source>
<year>2020</year>
<volume>4</volume>
<numero>3</numero>
<issue>3</issue>
<page-range>1-8</page-range></nlm-citation>
</ref>
<ref id="B34">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Study of JavaScript Static Analysis Tools for Vulnerability Detection in Node.js Packages]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[BRITO]]></surname>
<given-names><![CDATA[Tiago]]></given-names>
</name>
<name>
<surname><![CDATA[FERREIRA]]></surname>
<given-names><![CDATA[Mafalda]]></given-names>
</name>
<name>
<surname><![CDATA[MONTEIRO]]></surname>
<given-names><![CDATA[Miguel]]></given-names>
</name>
<name>
<surname><![CDATA[LOPES]]></surname>
<given-names><![CDATA[Pedro]]></given-names>
</name>
<name>
<surname><![CDATA[BARROS]]></surname>
<given-names><![CDATA[Miguel]]></given-names>
</name>
<name>
<surname><![CDATA[FRAGOSO]]></surname>
<given-names><![CDATA[Jose]]></given-names>
</name>
<name>
<surname><![CDATA[SANTOS]]></surname>
<given-names><![CDATA[Nuno.]]></given-names>
</name>
</person-group>
<source><![CDATA[: IEEE Transactions on Reliability]]></source>
<year>2023</year>
<volume>72</volume>
<numero>4</numero>
<issue>4</issue>
<page-range>1324-39</page-range></nlm-citation>
</ref>
<ref id="B35">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[A variable-level automated defect identification model based on machine learning.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[ZHANG]]></surname>
<given-names><![CDATA[Yuwei]]></given-names>
</name>
<name>
<surname><![CDATA[XING]]></surname>
<given-names><![CDATA[Ying]]></given-names>
</name>
<name>
<surname><![CDATA[GONG]]></surname>
<given-names><![CDATA[Yunzhan]]></given-names>
</name>
<name>
<surname><![CDATA[JIN]]></surname>
<given-names><![CDATA[Dahai]]></given-names>
</name>
<name>
<surname><![CDATA[LI]]></surname>
<given-names><![CDATA[Honghui]]></given-names>
</name>
<name>
<surname><![CDATA[LIU]]></surname>
<given-names><![CDATA[Feng]]></given-names>
</name>
</person-group>
<source><![CDATA[Soft Computing]]></source>
<year>2020</year>
<volume>24</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>1045-61</page-range></nlm-citation>
</ref>
<ref id="B36">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[An empirical study on combining diverse static analysis tools for web security vulnerabilities based on development scenarios]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[NUNES]]></surname>
<given-names><![CDATA[Paulo]]></given-names>
</name>
<name>
<surname><![CDATA[MEDEIROS]]></surname>
<given-names><![CDATA[Ibéria]]></given-names>
</name>
<name>
<surname><![CDATA[FONSECA]]></surname>
<given-names><![CDATA[José]]></given-names>
</name>
<name>
<surname><![CDATA[NEVES]]></surname>
<given-names><![CDATA[Nuno]]></given-names>
</name>
<name>
<surname><![CDATA[CORREIA]]></surname>
<given-names><![CDATA[Miguel]]></given-names>
</name>
<name>
<surname><![CDATA[VIEIRA]]></surname>
<given-names><![CDATA[Marco]]></given-names>
</name>
</person-group>
<source><![CDATA[Computing]]></source>
<year>2019</year>
<volume>101</volume>
<numero>2</numero>
<issue>2</issue>
<page-range>161-85</page-range></nlm-citation>
</ref>
<ref id="B37">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Concerns identified in code review: A fine-grained, faceted classification.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[GUNAWARDENA]]></surname>
<given-names><![CDATA[Sanuri]]></given-names>
</name>
<name>
<surname><![CDATA[TEMPERO]]></surname>
<given-names><![CDATA[Ewan]]></given-names>
</name>
<name>
<surname><![CDATA[BLINCOE]]></surname>
<given-names><![CDATA[Kelly.]]></given-names>
</name>
</person-group>
<source><![CDATA[Information and Software Technology]]></source>
<year>2023</year>
<volume>153</volume>
<page-range>1-14</page-range></nlm-citation>
</ref>
<ref id="B38">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Automated server-side model for recognition of security vulnerabilities in scripting languages]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[ABDEL-KADER]]></surname>
<given-names><![CDATA[Rabab]]></given-names>
</name>
<name>
<surname><![CDATA[NASHAAT]]></surname>
<given-names><![CDATA[Mona]]></given-names>
</name>
<name>
<surname><![CDATA[HABIB]]></surname>
<given-names><![CDATA[Mohamed]]></given-names>
</name>
<name>
<surname><![CDATA[MAHDI]]></surname>
<given-names><![CDATA[Hani.]]></given-names>
</name>
</person-group>
<source><![CDATA[International Journal of Electrical and Computer Engineering]]></source>
<year>2020</year>
<volume>10</volume>
<numero>6</numero>
<issue>6</issue>
<page-range>6061-70</page-range></nlm-citation>
</ref>
<ref id="B39">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Recognizing lines of code violating company-specific coding guidelines using machine learning: A Method and Its Evaluation.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[OCHODEK]]></surname>
<given-names><![CDATA[Miroslaw]]></given-names>
</name>
<name>
<surname><![CDATA[HEBIG]]></surname>
<given-names><![CDATA[Regina]]></given-names>
</name>
<name>
<surname><![CDATA[MEDING]]></surname>
<given-names><![CDATA[Wilhelm]]></given-names>
</name>
<name>
<surname><![CDATA[FROST]]></surname>
<given-names><![CDATA[Gert]]></given-names>
</name>
<name>
<surname><![CDATA[STARON]]></surname>
<given-names><![CDATA[Miroslaw]]></given-names>
</name>
</person-group>
<source><![CDATA[Empirical Software Engineering]]></source>
<year>2020</year>
<volume>25</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>220-65</page-range></nlm-citation>
</ref>
<ref id="B40">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[On the adoption of static analysis for software security assessment-A case study of an open-source e-government project]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[NGUYEN-DUC]]></surname>
<given-names><![CDATA[Anh]]></given-names>
</name>
<name>
<surname><![CDATA[VIET]]></surname>
<given-names><![CDATA[Manh]]></given-names>
</name>
<name>
<surname><![CDATA[LUONG]]></surname>
<given-names><![CDATA[Quan]]></given-names>
</name>
<name>
<surname><![CDATA[NGUYEN]]></surname>
<given-names><![CDATA[Kiem]]></given-names>
</name>
<name>
<surname><![CDATA[NGUYEN]]></surname>
<given-names><![CDATA[Anh]]></given-names>
</name>
</person-group>
<source><![CDATA[Computers &amp; Security]]></source>
<year>2021</year>
<volume>111</volume>
<page-range>1-14</page-range></nlm-citation>
</ref>
<ref id="B41">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Keyword-labeled self-admitted technical debt and static code analysis have significant relationship but limited overlap.]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[RANTALA]]></surname>
<given-names><![CDATA[Leevi]]></given-names>
</name>
<name>
<surname><![CDATA[MÄNTYLÄ]]></surname>
<given-names><![CDATA[Mika]]></given-names>
</name>
<name>
<surname><![CDATA[LENARDUZZI]]></surname>
<given-names><![CDATA[Valentina.]]></given-names>
</name>
</person-group>
<source><![CDATA[Software Quality Journal]]></source>
<year>2023</year>
<volume>32</volume>
<page-range>91-429</page-range></nlm-citation>
</ref>
<ref id="B42">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Reduction of False Positives for Runtime Errors in C/C++ Software: A Comparative Study]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[PARK]]></surname>
<given-names><![CDATA[Jihyun]]></given-names>
</name>
<name>
<surname><![CDATA[SHIN]]></surname>
<given-names><![CDATA[Jaeyoung]]></given-names>
</name>
<name>
<surname><![CDATA[CHOI]]></surname>
<given-names><![CDATA[Byoungju.]]></given-names>
</name>
</person-group>
<source><![CDATA[Electronics]]></source>
<year>2023</year>
<volume>12</volume>
<numero>3518</numero>
<issue>3518</issue>
<page-range>1-12</page-range></nlm-citation>
</ref>
<ref id="B43">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Deriving Static Security Testing from Runtime Security Protection for Web Applications]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[SCULL]]></surname>
<given-names><![CDATA[Angel]]></given-names>
</name>
<name>
<surname><![CDATA[NICOLAY]]></surname>
<given-names><![CDATA[Jens]]></given-names>
</name>
<name>
<surname><![CDATA[GONZALEZ]]></surname>
<given-names><![CDATA[Elisa.]]></given-names>
</name>
</person-group>
<source><![CDATA[Art, Science, and Engineering of Programming]]></source>
<year>2022</year>
<volume>6</volume>
<numero>1</numero>
<issue>1</issue>
<page-range>1-41</page-range></nlm-citation>
</ref>
<ref id="B44">
<nlm-citation citation-type="journal">
<article-title xml:lang=""><![CDATA[Static Code Analysis Alarms Filtering Reloaded: A New Real-World Dataset and its ML-Based Utilization]]></article-title>
<person-group person-group-type="author">
<name>
<surname><![CDATA[HEGEDUS]]></surname>
<given-names><![CDATA[Péter]]></given-names>
</name>
<name>
<surname><![CDATA[FERENC]]></surname>
<given-names><![CDATA[Rudolf.]]></given-names>
</name>
</person-group>
<source><![CDATA[IEEE]]></source>
<year>2022</year>
<volume>10</volume>
<page-range>55090-101</page-range></nlm-citation>
</ref>
</ref-list>
</back>
</article>
