Stanford research: "Automated Black Box Web Application Vulnerability Testing" http://is.gd/ayEeF Paper to be published later this year.