Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools
arXiv:2407.14255 · doi:10.3390/jcp4030021
Abstract
The majority of Ethical Hacking (EH) tools utilised in penetration testing are developed by practitioners within the industry or underground communities. Similarly, academic researchers have also contributed to developing security tools. However, there appears to be limited awareness among practitioners of academic contributions in this domain, creating a significant gap between industry and academia's contributions to EH tools. This research paper aims to survey the current state of EH academic research, primarily focusing on research-informed security tools. We categorise these tools into process-based frameworks (such as PTES and Mitre ATT\&CK) and knowledge-based frameworks (such as CyBOK and ACM CCS). This classification provides a comprehensive overview of novel, research-informed tools, considering their functionality and application areas. The analysis covers licensing, release dates, source code availability, development activity, and peer review status, providing valuable insights into the current state of research in this field.
arXiv commentThis is the extended version of the paper published in the Journal of Cybersecurity and Privacy, 4, no. 3: pp 410-448, 2024
References in corpus (10)
- VulDeePecker: A Deep Learning-Based System for Vulnerability Detection
- HARMer: Cyber-attacks Automation and Evaluation
- RAT: Reinforcement-Learning-Driven and Adaptive Testing for Vulnerability Discovery in Web Application Firewalls
- ESASCF: Expertise Extraction, Generalization and Reply Framework for an Optimized Automation of Network Security Compliance
- CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects
- GNPassGAN: Improved Generative Adversarial Networks For Trawling Offline Password Guessing
- Reducing Bias in Modeling Real-world Password Strength via Deep Learning and Dynamic Dictionaries
- Deemon: Detecting CSRF with Dynamic Analysis and Property Graphs
- PassGPT: Password Modeling and (Guided) Generation with Large Language Models
- Never Trust Your Victim: Weaponizing Vulnerabilities in Security Scanners