一句话：提出基于多层知识图与多智能体系统的静态分析工具 KAVe，高精度检测 Web 应用的 XSS 与 SQLi 漏洞。
Web 应用被广泛用于各类服务，但快速开发常以牺牲安全为代价，导致 XSS、SQLi 等漏洞持续存在。本文提出 KAVe，一种静态分析工具，通过结合多层知识图与多智能体系统来检测 Web 应用漏洞，目标是在真实 PHP 应用中实现高精度识别。论文展示 KAVe 的实现，并评估其在真实 PHP 应用中发现的 SQL 注入（SQLi）与跨站脚本（XSS）漏洞的能力。结果表明，KAVe 能够利用多层知识图和多智能体协作定位这两类漏洞，为安全检测提供支持。
Web applications have been widely adopted to access a myriad of services, regardless of their criticality and context. Applications developers have accelerated their efforts to meet the demands of a competitive and dynamic market for innovative products. Despite considerable efforts to detect and mitigate vulnerabilities in applications, their prevalence continues to increase, primarily due to the rapid pace of software development, which often prioritizes deployment speed, compromising security. This paper presents KAVe, a static analysis tool that leverages a multi-layer knowledge graph and a multi-agent system to detect web application vulnerabilities with high precision. This paper showcases KAVe's implementation and ability to identify SQL injection (SQLi) and cross-site scripting (XSS) vulnerabilities in real-world PHP applications.
@inproceedings{paperbot9157,
title = {KAVe: A Tool to Detect XSS and SQLi Vulnerabilities using a Multi-Agent System over a Multi-Layer Knowledge Graph},
author = {Rafael Ramires and Ana Respício and Ibéria Medeiros and Mike Papadakis},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3728601}
}