journal article
Open Access
Dec 27, 2024
Intelligent Platform for Automating Vulnerability Detection in Web Applications
Abstract
In a world increasingly dependent on technology and in an era where connectivity is omnipresent, Web applications have become an essential part of our everyday life. The evolution of these applications, combined with the exponential increase in the number of users, has brought with it not only convenience but also significant challenges in terms of security. Ensuring the security of Web applications and their data is increasingly a priority for companies, although many companies lack the know-how, time, and money to do so. This research project studied and developed a system with the aim of automating the process of detecting vulnerabilities in Web applications by exploiting the benefits of the interoperability of the two forms of automation of the tool selected to carry out this analysis. The developed solution is low-cost and requires very little user intervention. In order to validate and evaluate the developed platform, experiments were carried out on applications with different types of vulnerabilities known in advance and on real applications. It is essential to guarantee the security of Web applications, and the developed system proved capable of automating the detection of vulnerability risks and returning the results in a relatively simple way for the user.
Topics
No keywords indexed for this article. Browse by subject →
References
32
[1]
Althunayyan, M., Saxena, N., Li, S., and Gope, P. (2022). Evaluation of Black-Box Web Application Security Scanners in Detecting Injection Vulnerabilities. Electronics, 11.
10.3390/electronics11132049
[2]
Djeki, E., Degila, J., Bondiombouy, C., and Alhassan, M.H. (2021, January 17–19). Security Issues in Digital Learning Spaces. Proceedings of the 2021 IEEE International Conference on Computing, ICOCO 2021, Kuala Lumpur, Malaysia.
10.1109/icoco53166.2021.9673575
[3]
Shahid, J., Hameed, M.K., Javed, I.T., Qureshi, K.N., Ali, M., and Crespi, N. (2022). A Comparative Study of Web Application Security Parameters: Current Trends and Future Directions. Appl. Sci., 12.
10.3390/app12084077
[4]
Petrosyan, A. (2024, December 22). Distribution of Cyber Incidents in Organizations Worldwide as of September 2023, by Type. Statista, Available online: https://www.statista.com/statistics/1483769/global-cyber-incidents-by-type/.
[5]
Muralidharan, M., Babu, K.B., and Sujatha, G. (2023, January 20–21). W3BnNr: An Automated tool for information gathering, vulnerability scanning, attacking and reporting for injection attacks on web application. Proceedings of the ACCTHPA 2023—Conference on Advanced Computing and Communication Technologies for High Performance Applications, Ernakulam, India.
10.1109/accthpa57160.2023.10083380
[6]
Lavens, E., Philippaerts, P., and Joosen, W. (2022, January 23–26). A Quantitative Assessment of the Detection Performance of Web Vulnerability Scanners. Proceedings of the ACM International Conference Proceeding Series, Association for Computing Machinery, Vienna, Austria.
10.1145/3538969.3544416
[7]
OWASP (2024, December 22). OWASP Top 10. OWASP Foundation. Available online: https://owasp.org/www-project-top-ten/.
[8]
Sonmez "Holistic Web Application Security Visualization for Multi-Project and Multi-Phase Dynamic Application Security Test Results" IEEE Access (2021) 10.1109/access.2021.3057044
[9]
Seara, J.P., and Serrao, C. (2024). Automation of System Security Vulnerabilities Detection Using Open-Source Software. Electronics, 13.
10.3390/electronics13050873
[10]
Seara "Intelligent System for Automation of Security Audits (SIAAS)" EAI Endorsed Trans. Scalable Inf. Syst. (2023)
[11]
Truong, D., Tran, D., Nguyen, L., Mac, H., Tran, H.A., and Bui, T. (2019, January 4–6). Detecting web attacks using stacked denoising autoencoder and ensemble learning methods. Proceedings of the ACM International Conference Proceeding Series, Association for Computing Machinery, Hanoi Ha Long Bay, Vietnam.
10.1145/3368926.3369715
[12]
Petrosyan, A. (2024, December 22). Global Industry Sectors Most Targeted by Basic Web Application Attacks from November 2022 to October 2023 Statista 2024. Available online: https://www.statista.com/statistics/221293/cyber-crime-target-industries/.
[13]
Nirmal, K., Janet, B., and Kumar, R. (2018, January 14–15). It’s more than stealing cookies—Exploitability of XSS. Proceedings of the 2018 International Conference on Intelligent Computing and Control Systems (ICICCS), Madurai, India.
10.1109/iccons.2018.8663230
[14]
Li "A Survey on Web Application Security" Nashville, TN USA (2011)
[15]
Nocera, S., Romano, S., Francese, R., and Scanniello, G. (2024, January 14–20). Training for Security: Results from Using a Static Analysis Tool in the Development Pipeline of Web Apps. Proceedings of the International Conference on Software Engineering, Lisbon, Portugal.
10.1145/3639474.3640073
[16]
Goe, D. (2015, January 13–15). Detection of Web Appication Vulnerability Based on RUP Model. Proceedings of the 2015 National Conference on Recent Advances in Electronics & Computer Engineering (RAECE), Roorkee, India.
[17]
MITRE (2024, December 22). CWE Top 25 Most Dangerous Software Weaknesses. Mitre, Available online: https://cwe.mitre.org/top25/.
[18]
Verma "A Comparative Study of Black Box Testing and White Box Testing" Artic. Int. J. Comput. Sci. Eng. (2017)
[19]
Hassan "Quantitative Assessment of Remote Code Execution Vulnerability in Web Apps" Proceedings of the Lecture Notes in Electrical Engineering (2020) 10.1007/978-981-15-2317-5_53
[20]
Singh, N., Meherhomji, V., and Chandavarkar, B.R. (2020, January 1–3). Automated versus Manual Approach of Web Application Penetration Testing. Proceedings of the 2020 11th International Conference on Computing, Communication and Networking Technologies (ICCCNT), Kharagpur, India.
10.1109/icccnt49239.2020.9225385
[21]
Acheampong, R., Balan, T.C., Popovici, D.M., and Rekeraho, A. (2022, January 16–18). Security Scenarios Automation and Deployment in Virtual Environment using Ansible. Proceedings of the 14th International Conference on Communications, COMM 2022, Bucharest, Romania.
10.1109/comm54429.2022.9817150
[22]
Beba, S., Karlsen, M.M., Li, J., and Zhang, B. (2021, January 6–9). Critical Understanding of Security Vulnerability Detection Plugin Evaluation Reports. Proceedings of the Asia-Pacific Software Engineering Conference, APSEC, Taipei, Taiwan.
10.1109/apsec53868.2021.00035
[23]
Al-Kahla, W., Shatnawi, A.S., and Taqieddin, E. (2021, January 24–26). A Taxonomy of Web Security Vulnerabilities. Proceedings of the 2021 12th International Conference on Information and Communication Systems, ICICS 2021, Valencia, Spain.
10.1109/icics52457.2021.9464576
[24]
Idrissi "Performance Evaluation of Web Application Security Scanners for Prevention and Protection against Vulnerabilities" Int. J. Appl. Eng. Res. (2017)
[25]
Koswara, K.J., and Asnar, Y.D.W. (2019, January 13–14). Improving Vulnerability Scanner Performance in Detecting AJAX Application Vulnerabilities. Proceedings of the 2019 International Conference on Data and Software Engineering (ICoDSE): Gedung Konferensi Universitas Tanjungpura, Pontianak, Indonesia.
10.1109/icodse48700.2019.9092613
[26]
Qasaimeh "Black Box Evaluation of Web Application Scanners: Standards Mapping Approach" J. Theor. Appl. Inf. Technol. (2018)
[27]
Jain, T., and Jain, N. (2019, January 7–8). Framework for Web Application Vulnerability Discovery and Mitigation by Customizing Rules through ModSecurity. Proceedings of the 2019 6th International Conference on Signal Processing and Integrated Networks (SPIN), Noida, India.
10.1109/spin.2019.8711673
[28]
Abdulghaffar, K., Elmrabit, N., and Yousefi, M. (2023). Enhancing Web Application Security through Automated Penetration Testing with Multiple Vulnerability Scanners. Computers, 12.
10.3390/computers12110235
[29]
Albahar, M., Alansari, D., and Jurcut, A. (2022). An Empirical Comparison of Pen-Testing Tools for Detecting Web App Vulnerabilities. Electronics, 11.
10.3390/electronics11192991
[30]
Mburano, B., and Si, W. (2018, January 18–20). Evaluation of Web Vulnerability Scanners Based on OWASP Benchmark. Proceedings of the ICSEng 2018: 26th International Conference on Systems Engineering, Sydney, Australia.
10.1109/icseng.2018.8638176
[31]
Team, Z.D. (2024, December 22). ZAP. Available online: https://www.zaproxy.org/.
[32]
Portugal (2024, December 22). Lei n.º 109-2009. Diário da Républica. Série I de 2009-09-15. Available online: https://diariodarepublica.pt/dr/detalhe/lei/109-2009-489693.
Metrics
2
Citations
32
References
Details
- Published
- Dec 27, 2024
- Vol/Issue
- 14(1)
- Pages
- 79
- License
- View
Authors
Cite This Article
Diogo Moreira, João Pedro Seara, João Pedro Pavia, et al. (2024). Intelligent Platform for Automating Vulnerability Detection in Web Applications. Electronics, 14(1), 79. https://doi.org/10.3390/electronics14010079
Related
You May Also Like
Machine Learning Interpretability: A Survey on Methods and Metrics
Diogo V. Carvalho, Eduardo M. Pereira · 2019
1,384 citations
The k-means Algorithm: A Comprehensive Survey and Performance Evaluation
Mohiuddin Ahmed, Raihan Seraj · 2020
1,342 citations
CNN Variants for Computer Vision: History, Architecture, Application, Challenges and Future Scope
Dulari Bhatt, Chirag Patel · 2021
730 citations
Conduction Mechanism of Valence Change Resistive Switching Memory: A Survey
Ee Lim, Razali Ismail · 2015
716 citations
Sentiment Analysis Based on Deep Learning: A Comparative Study
Nhan Cach Dang, María N. Moreno-García · 2020
550 citations