Generative Adversarial Network (GAN)-Based Autonomous Penetration Testing for Web Applications.

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Web Application Security

Background:

• The rapid growth of web applications, Wireless Sensor Networks (WSNs), and the Internet of Things (IoT) necessitates advanced security measures.
• Current security research relies on manual penetration testing and source code analysis to find vulnerabilities like Cross-Site Scripting (XSS) and SQL Injection.
• Existing attack samples are often easily blocked by Web Application Firewalls (WAFs).

Purpose of the Study:

• To propose an autonomous penetration testing framework for web applications.
• To develop a method for generating attack samples that can bypass Web Application Firewalls (WAFs).
• To leverage Generative Adversarial Networks (GANs) for automated vulnerability detection and exploitation.

Main Methods:

• Utilized Generative Adversarial Networks (GANs) with conditional sequence generation to overcome limitations of vanilla GANs.
• Employed semantic tokenization to identify key features for Cross-Site Scripting (XSS) attacks.
• Trained a generative model using attack labels and identified attack features to generate attack payloads.

Main Results:

• Successfully generated attack samples capable of targeting WAF-protected web applications in an automated manner.
• The conditional sequence GAN technique effectively identified key features for XSS attacks.
• The proposed framework demonstrates scalability on large-scale web application platforms.

Conclusions:

• The autonomous penetration testing framework using conditional sequence GANs offers an effective solution for identifying web application vulnerabilities.
• This approach significantly reduces the manual effort required for penetration testing.
• The generated attack samples are capable of bypassing traditional security measures like WAFs, enhancing automated security assessments.