关键词: Web应用软件, 安全漏洞, 分类模型

Abstract: This paper studies how the environmental fault and states fault cause the security problems of Web application，and describes a taxonomy model using analytic hierarchy process for classifying security flaws of Web application.Then design an experiment to apply the taxonomy model to classify 152 security flaws from the CVE security flaw database，and compare the classification results with that of using EAI model to classify security flaws.The results of the experiment reveals that the taxonomy model is effective and applicable to the security testing and defending of Web-based application.

Key words: Web-based application, security flaw, taxonomy model