An Automated Vulnerability Assessment Engine for Web Applications Using Directed Fuzzing

International Journal of Computer Science and Technology | Vol. 14, No. 1, January 2012 | pp. 1–7
DOI: 10.46882/2012/IJCST/000119

Research Article

Title: An Automated Vulnerability Assessment Engine for Web Applications Using Directed Fuzzing

Names of Authors: Charles T. Vance¹, Yukihiro Matsumoto²

Authors’ Affiliations: ¹Department of Software Security, University of Cambridge, Cambridge, UK; ²Software Engineering Labs, Tsukuba University, Tsukuba, Japan

Abstract: Web application security remains a critical concern for financial networks, e-commerce stores, and government portals as SQL injection and cross-site scripting (XSS) risks escalate. Manual code audits are time-consuming and often miss hidden logic flaws in large software bases. This article describes an Automated Vulnerability Assessment Engine (AVAE) that utilizes directed grey-box fuzzing to uncover security gaps in web applications. AVAE dynamically traces execution paths, injecting targeted exploit payloads into input parameters and monitoring database errors or script executions. The system uses a genetic feedback model to prioritize inputs that trigger uncommon execution paths or deep code blocks. Testing AVAE against the Web Goat benchmark suite yielded a 94.2% vulnerability detection accuracy score, uncovering 14 previously unlisted cross-site scripting bugs. The false positive rate remained below 3.4%, outperforming standard static vulnerability scanner tools. The system completed full application reviews within an average time of 42 minutes, establishing its utility as an automated quality gate within continuous software delivery pipelines.

Keywords: Web Security, Fuzz Testing, Vulnerability Assessment, SQL Injection, Cross-Site Scripting, Software Quality

Manuscript Timeline: Received October 05, 2011; Revised November 20, 2011; Accepted December 10, 2011; Published January 22, 2012.

Citation: Vance, C. T., & Matsumoto, Y. (2012). An Automated Vulnerability Assessment Engine for Web Applications Using Directed Fuzzing. International Journal of Computer Science and Technology, 14(1), 1–7.

Subscribe to read the full article: https://www.internationalscholarsjournals.org/subscribe-to-read