Most existing surveys and reviews on web application vulnerability detection (WAVD) approaches focus on comparing and summarizing the approaches’ technical details. Although some studies have analyzed the efficiency and effectiveness of specific methods, there is a lack of a comprehensive and systematic analysis of the efficiency and effectiveness of various WAVD approaches. We conducted a systematic literature review (SLR) of WAVD approaches and analyzed their efficiency and effectiveness. We identified 105 primary studies out of 775 WAVD articles published between January 2008 and June 2019. Our study identified 10 categories of artifacts analyzed by the WAVD approaches and 8 categories of WAVD meta-approaches for analyzing the artifacts. Our study’s results also summarized and compared the effectiveness and efficiency of different WAVD approaches on detecting specific categories of web application vulnerabilities and which web applications and test suites are used to evaluate the WAVD approaches. To our knowledge, this is the first SLR that focuses on summarizing the effectiveness and efficiencies of WAVD approaches. Our study results can help security engineers choose and compare WAVD tools and help researchers identify research gaps.

中文翻译：

---

Web 应用程序漏洞检测方法的效率和有效性：回顾

大多数现有的关于 Web 应用程序漏洞检测 (WAVD) 方法的调查和评论都侧重于比较和总结这些方法的技术细节。尽管一些研究分析了具体方法的效率和有效性，但缺乏对各种 WAVD 方法的效率和有效性的全面系统分析。我们对 WAVD 方法进行了系统文献回顾 (SLR)，并分析了它们的效率和有效性。我们在 2008 年 1 月至 2019 年 6 月期间发表的 775 篇 WAVD 文章中确定了 105 篇主要研究。我们的研究确定了 WAVD 方法分析的 10 类工件和用于分析工件的 8 类 WAVD 元方法。我们的研究结果还总结和比较了不同 WAVD 方法在检测特定类别的 Web 应用程序漏洞方面的有效性和效率，以及使用哪些 Web 应用程序和测试套件来评估 WAVD 方法。据我们所知，这是第一个专注于总结 WAVD 方法的有效性和效率的 SLR。我们的研究结果可以帮助安全工程师选择和比较 WAVD 工具，并帮助研究人员发现研究空白。