# TPSQLi: Test Prioritization for SQL Injection Vulnerability Detection in Web Applications
## 5 Evaluation
### Weights for Test
#### 5.3.3 Discussion of Effectiveness  
Like ART4 SQLi [9], we discuss the effectiveness of our test prioritization process and compare it with ART4 SQLi. In TPSQLi, when a payload successfully exposes a vulnerability in the web application, it is considered valid and treated as a true positive. If the payload detects the final vulnerability, TPSQLi halts, marking the payload as valid. All payloads tested before this last successful one, which did not lead to exploiting a vulnerability, are considered false positives (they are flagged as suspicious but ultimately invalid). \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline
**Test Target** & **Method** & \(T_{max}\) & \(T_{min}\) & \(T_{mean}\) & \(T_{std}\) & \(|Z|\) \\ \hline DVWA & ART4 SQLi [9] & 405.80 & 349.90 & 369.11 & 20.37 & \multirow{2}{*}{1.68} \\ (SQL-blind) & TPSQLi & **359.9** & **307.06** & **331.26** & **14.47** & \\ \hline DVWA (SQL) & ART4 SQLi [9] & 913.55 & 834.79 & 862.39 & 31.95 & \multirow{2}{*}{0.059} \\  & TPSQLi & **898.65** & **836.08** & **859.97** & **25.52** & \\ \hline R1 & ART4 SQLi [9] & 68.48 & 64.26 & 65.82 & 1.69 & \multirow{2}{*}{17.04} \\  & TPSQLi & **32.42** & **29.28** & **30.44** & **1.21** & \\ \hline R2 & ART4 SQLi [9] & 157.61 & 141.22 & 146.07 & 6.76 & \multirow{2}{*}{5.50} \\  & TPSQLi & **109.82** & **99.45** & **102.73** & **4.07** & \\ \hline R3 & ART4 SQLi [9] & 94.11 & 87.41 & 90.68 & 2.65 & \multirow{2}{*}{20.66} \\  & TPSQLi & **35.69** & **34.67** & **35.15** & **0.46** & \\ \hline R4 & ART4 SQLi [9] & 22.63 & 20.10 & **21.00** & 0.99 & \multirow{2}{*}{0.04} \\  & TPSQLi & **22.47** & **20.32** & 21.06 & **0.85** & \\ \hline R5 & ART4 SQLi [9] & 395.77 & 351.55 & 368.99 & 16.29 & \multirow{2}{*}{5.86} \\  & TPSQLi & **275.34** & **259.71** & **267.65** & **5.83** & \\ \hline R6 & ART4 SQLi [9] & 128.62 & 121.16 & 124.49 & 3.10 & \multirow{2}{*}{2.67} \\  & TPSQLi & **116.81** & **109.65** & **113.21** & **2.88** & \\ \hline R7 & ART4 SQLi [9] & 332.98 & 319.94 & 325.47 & 5.69 & \multirow{2}{*}{9.49} \\  & TPSQLi & **256.94** & **244.99** & **250.87** & **5.43** & \\ \hline R8 & ART4 SQLi [9] & 79.27 & 78.18 & 78.72 & 0.44 & \multirow{2}{*}{32.16} \\  & TPSQLi & **61.90** & **61.15** & **61.63** & **0.30** & \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Comparisons between ART4 SQLi and TPSQLi. If TPSQLi stops after the \(p^{th}\) payload (where \(p\geq 1\) and the payload is valid), and the number of the valid payloads before \(p^{th}\) is \(v\), the \(p-v-1\) payloads are categorized as false positives. In contrast, the \(v+1\) payloads are considered as true positive. Since TPSQLi terminates once the last valid payload is detected, neither true nor false negatives are accounted for in this analysis. We designed a new metric, the False Positive Measure (\(FPM\)), to systematically compare the false positives. This metric is defined as:  
\[FPM=\frac{Total\ Executed\ Payloads}{False\ Positive} \tag{5}\]  
A higher \(FPM\) indicates a more effective process, implying fewer false positives than the number of executed payloads. To further quantify the improvement of TPSQLi over ART4 SQLi, we also introduce an Improved Rate (\(IR\)), calculated as:  
\[IR=\frac{FPM_{\text{TPSQLi}}-FPM_{\text{ART4 SQLi}}}{FPM_{\text{ART4 SQLi}}} \times 100\% \tag{6}\]  
The \(IR\) expresses the percentage improvement offered by TPSQLi over ART4 SQLi. As shown in Table 5, TPSQLi delivers significant enhancements, particularly for test targets R1 and R3, with \(IR\) values of 19.95% and 16.62%, respectively. On average, TPSQLi demonstrates a 4.65% overall improvement, indicating consistent efficiency gains across different web applications. Notably, no improvement was observed on test targets DVWA(SQL) and R4, as the original order in both cases was optimal, resulting in identical \(FPM\) values for both TPSQLi and ART4 SQLi. This analysis highlights that our test prioritization method effectively reduces false positives and improves the accuracy of SQL injection detection.