Architecture and Model of Neural Network Based Service for Choice of the Penetration Testing Tools
DOI:
https://doi.org/10.47839/ijc.20.4.2438Keywords:
neural network, web service, cybersecurity, penetration testing, web applications, toolsAbstract
During penetration testing of web applications, different tools are actively used to relieve the tester from repeating monotonous operations. The difficulty of the choice is in the fact that there are tools with similar functionality, and it is hard to define which tool is best to choose for a particular case. In this paper, a solution of the problem with making a choice by creating a Web service that will use a neural network on the server side is proposed. The neural network is trained on data obtained from experts in the field of penetration testing. A trained neural network will be able to select tools in accordance with specified requirements. Examples of the operation of a neural network trained on a small sample of data are shown. The effect of the number of neural network learning epochs on the results of work is shown. An example of input data is given, in which the neural network could not select the tool due to insufficient data for training. The advantages of the method shown are the simplicity of implementation (the number of lines of code is used as a metric) and the possibility of using opinions about tools from various experts. The disadvantages include the search for data for training, the need for experimental selection of the parameters of the neural network and the possibility of situations where the neural network will not be able to select tool that meets the specified requirements.
References
M. Vieira, N. Antunes and H. Madeira, “Using web security scanners to detect vulnerabilities in web services,” in Proceedings of the 2009 IEEE/IFIP International Conference on Dependable Systems & Networks, Lisbon, Portugal, June 29 - July 2, 2009, pp. 566-571. https://doi.org/10.1109/DSN.2009.5270294.
N. Awang and A. Manaf, “Detecting vulnerabilities in web applications using automated black box and manual penetration testing,” in Proceedings of the International Conference on Advances in Security of Information and Communication Networks SecNet’2013, Cairo, Egypt, September 3-5, 2013, pp. 230-239. https://doi.org/10.1007/978-3-642-40597-6_20.
F. R. Muñoz, I. I. S. Cortes and L. J. G. Villalba, “Enlargement of vulnerable web applications for testing,” The Journal of Supercomputing, vol. 74, issue 12, pp. 6598-6617, 2018. https://doi.org/10.1007/s11227-017-1981-2.
A. Doupé, M. Cova and G. Vigna, “Why Johnny can’t pentest: An analysis of black-box web vulnerability scanners,” in Proceedings of the International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment DIMVA’2010, Bonn, Germany, July 8-9, 2010, pp. 111-131. https://doi.org/10.1007/978-3-642-14215-4_7.
M. C. Nicoletti, J. R. Bertini Jr., D. Elizondo, L. Franco and J. M. Jerez, “Constructive neural network algorithms for feedforward architectures suitable for classification tasks,” in: L. Franco, D. A. Elizondo, J. M. Jerez (Eds.), Constructive Neural Networks, Berlin, Heidelberg, 2010, pp. 1-23. https://doi.org/10.1007/978-3-642-04512-7_1.
R. Sadeghian and M. R. Sadeghian, “A decision support system based on artificial neural network and fuzzy analytic network process for selection of machine tools in a flexible manufacturing system,” International Journal of Advanced Manufacturing Technology, vol. 82, issue 9-12, pp. 1795-1803, 2016. https://doi.org/10.1007/s00170-015-7440-4.
J. Saxe and K. Berlin, “Deep neural network based malware detection using two dimensional binary program features,” in Proceedings of the 2015 10th International Conference on Malicious and Unwanted Software (MALWARE), Fajardo, Puerto Rico, October 20-22, 2015, pp. 11-20. https://doi.org/10.1109/MALWARE.2015.7413680.
M. Alazab, S. Venkatraman, S. Watters and M. Alazab, “Zero-day malware detection based on supervised learning algorithms of API call signatures,” in Proceedings of the Ninth Australasian Data Mining Conference, vol. 121, Ballarat, Australia, December 1-2, 2011, pp. 171-182.
A. S. Ashoor and S. Gore, “Difference between intrusion detection system (IDS) and intrusion prevention system (IPS),” in Proceedings of the International Conference on Network Security and Applications, Chennai, India, July 15-17, 2011, pp. 497-501. https://doi.org/10.1007/978-3-642-22540-6_48.
S. S. Roy, A. Mallik, R. Gulati, M. S. Obaidat and P. V. Krishna, “A deep learning based artificial neural network approach for intrusion detection,” in Proceedings of the International Conference on Mathematics and Computing, Haldia, India, January 17-21, 2017, pp. 44-53. https://doi.org/10.1007/978-981-10-4642-1_5.
A. Tetskyi, V. Kharchenko and D. Uzun, “Neural networks based choice of tools for penetration testing of web applications,” in Proceedings of the 2018 IEEE 9th International Conference on Dependable Systems, Services and Technologies (DESSERT’2018), Kyiv, Ukraine, May 24-27, 2018, pp. 402-405. https://doi.org/10.1109/DESSERT.2018.8409167.
S. Nissen and E. Nemerson, Fast Artificial Neural Network Library (FANN), [Online]. Available at: http://leenissen.dk/fann/html/files/fann-h.html
M. Mirjalili, A. Nowroozi and M. Alidoosti, “A survey on web penetration test,” Advances in Computer Science: An International Journal, Los Alamitos, CA, vol. 3, issue 6, no. 12, pp. 107-121, 2014.
J. E. Dayhoff and J. M. DeLeo, “Artificial neural networks: opening the black box,” Cancer: Interdisciplinary International Journal of the American Cancer Society, vol. 91, no. S8, pp. 1615-1635, 2001. https://doi.org/10.1002/1097-0142(20010415)91:8+<1615::AID-CNCR1175>3.0.CO;2-L.
C. Y. Chen, J. R. C. Hsu and C. W. Chen, “Fuzzy logic derivation of neural network models with time delays in subsystems,” International Journal on Artificial Intelligence Tools, vol. 14, no. 6, pp. 967-974, 2005. https://doi.org/10.1142/S021821300500248X.
Kali Linux Tools Listing, 2019, [Online]. Available at: https://tools.kali.org/tools-listing
H. Park and S. Baek, “An empirical validation of a neural network model for software effort estimation,” Expert Systems with Applications: An International Journal, vol. 35, issue 3, pp. 929-937, 2008. https://doi.org/10.1016/j.eswa.2007.08.001.
T. Masters, Practical Neural Network Recipes in C++, Morgan Kaufmann, 1993, 493 p. https://doi.org/10.1016/B978-0-08-051433-8.50017-3.
X. Glorot and Y. Bengio, “Understanding the difficulty of training deep feedforward neural networks,” in Proceedings of the Thirteenth International Conference on Artificial Intelligence and Statistics, Sardinia, Italy, May 13-15, 2010, pp. 249-256.
C. Igel and M. Hüsken, Improving the Rprop Learning Algorithm, in: H. Bothe, R. Rojas (Eds.), Proceedings of the Second International ICSC Symposium on Neural Computation (NC 2000), vol. 2000, ICSC Academic Press, 2000, pp. 115-121.
R. Setiono, “Feedforward neural network construction using cross validation,” Neural Computation, vol. 13, no. 12, pp. 2865-2877, 2001. https://doi.org/10.1162/089976601317098565.
Downloads
Published
How to Cite
Issue
Section
License
International Journal of Computing is an open access journal. Authors who publish with this journal agree to the following terms:• Authors retain copyright and grant the journal right of first publication with the work simultaneously licensed under a Creative Commons Attribution License that allows others to share the work with an acknowledgement of the work's authorship and initial publication in this journal.
• Authors are able to enter into separate, additional contractual arrangements for the non-exclusive distribution of the journal's published version of the work (e.g., post it to an institutional repository or publish it in a book), with an acknowledgement of its initial publication in this journal.
• Authors are permitted and encouraged to post their work online (e.g., in institutional repositories or on their website) prior to and during the submission process, as it can lead to productive exchanges, as well as earlier and greater citation of published work.
