Метод пошуку вразливостей вебзастосунків з використанням API ChatGPT
DOI:
https://doi.org/10.32347/st.2024.2.1203Ключові слова:
кібербезпека, автоматизація тестування, етичний хакінг, GPT, ChatGPT API, пентестинг, вебзастосункиАнотація
This paper presents a method for automating web application testing using the ChatGPT API, designed to help ethical hackers identify vulnerabilities. The goal of the research is to develop an approach that improves the efficiency and accuracy of pentesting, focusing on the automation of processes that are traditionally performed manually. The proposed method is based on the capabilities of the GPT model to generate test requests and analyze server responses, which allows detecting potential vulnerabilities without the need for detailed analysis of the source code. The presented results demonstrate the advantages of using GPT models for generating complex test scenarios and analyzing web application responses, which helps identify potential threats. The results of the experiments showed an increase in the accuracy of vulnerability detection by 15-20% and a reduction in testing time by 35% compared to traditional methods. The proposed approach is promising for implementation in the practice of ethical hacking and cyber security.
Посилання
OWASP Foundation. (2020). OWASP Web Security Testing Guide v4.2. OWASP Foundation. Retrieved from https://owasp.org/www-project-top-ten/
Chio, C., & Freeman, D. (2018). Machine Learning and Security: Protecting Systems with Data and Algorithms. O'Reilly Media.
Brown, T. B., et al. (2020). Language models are few-shot learners. Advances in Neural Information Processing Systems, 33, 1877-1901.
Radford, A., Wu, J., Child, R., et al. (2019). Language models are unsupervised multitask learners. OpenAI Blog. Retrieved from https://openai.com/blog/language-models
Zhang, J., Lin, Y., & Sun, M. (2019). A survey of deep learning techniques for vulnerability detection. IEEE Access, 7, 167757-167786.
Lienkov, S. V., Dzhulii, V. M., Bernaz, A. M., Muliar, I. V., & Pampukha, I. V. (2023). Metod prohnozuvannia vrazlyvostei informatsiinoi bezpeky na osnovi analizu danykh tematychnykh internet-resursiv. Zbirnyk naukovykh prats Viiskovoho instytutu Kyivskoho natsionalnoho universytetu imeni Tarasa Shevchenka, 78, 123-133. https://doi.org/10.17721/2519-481X/2023/78-1
Vaswani, A., Shazeer, N., Parmar, N., et al. (2017). Attention is all you need. Advances in Neural Information Processing Systems, 30, 5998-6008.
Lin, H., Liu, Z., Sun, M., et al. (2021). A survey on transformers in natural language processing. Journal of Artificial Intelligence Research, 70, 321-362.
Raff, E., Barker, J., Sylvester, J., et al. (2018). Malware detection by eating a whole EXE. In Workshops at the Thirty-Second AAAI Conference on Artificial Intelligence.
Vlasenko, M. та Khlaponin, Y., (2023). The Internet of Things (IoT) in World Practice: Review and Analysis. Pidvodni tehnologii. (13), 21–27. doi: 10.32347/uwt.2023.13.1202
Ilyas, A., Engstrom, L., Athalye, A., & Lin, J. (2018). Black-box adversarial attacks with limited queries and information. In Proceedings of the 35th International Conference on Machine Learning.
Subramanian, S., Dheeru, D., Ravi, S., & McAuley, J. (2021). Scaling laws for transfer learning in neural language models. arXiv preprint arXiv:2109.07841. Retrieved from https://arxiv.org/abs/2109.07841
Korchenko, O. H., Domin, V. Ye., & Kokhanovskyi, V. P. (2020). Kiberbezpeka ta shtuchnyi intelekt: vyklyky ta perspektyvy. Kyiv: KNU.Wang, S., et al. (2020). Detecting code vulnerabilities via graph neural network. IEEE Transactions on Dependable and Secure Computing.
Misnyk, S. V. (2019). Vykorystannia neironnykh merezh dlia vyiavlennia vrazlyvostei u veb-dodatkakh. Naukovyi visnyk NTUU "KPI". Seriia: Informatsiini tekhnolohii, 3, 45-52.
Li, Z., Zou, D., Xu, S., et al. (2018). VulDeePecker: A deep learning-based system for vulnerability detection. In Proceedings of the 25th Annual Network and Distributed System Security Symposium (NDSS).
Zhang, J., Lin, Y., & Sun, M. (2019). A survey of deep learning techniques for vulnerability detection. IEEE Access, 7, 167757-167786.
Chakraborty, S., Shahriar, H., & Clincy, V. (2016). Detection of SQL injection and cross-site scripting attacks using static analysis. In Proceedings of the 2016 ACM Southeast Conference. 174-177.
##submission.downloads##
Опубліковано
Як цитувати
Номер
Розділ
Ліцензія
Авторське право (c) 2024 Ihor Mulyar, Serhiy Lenkov, Volodymyr Glowyuk, Volodymyr Anikin, Yevgeny Sotnikov
Ця робота ліцензується відповідно до Creative Commons Attribution-NonCommercial 4.0 International License.
Автор(и) та Редакція згодні на те, що Редакція також матиме право:
- здійснювати необхідне оформлення Твору/Статті за результатами його редакційної обробки;
- визначати самостійно кількість видань, друк додаткових копій і тираж Твору/Статті, кількість копій окремих видань і додаткових тиражів;
- опублікування Твору/Статті в інших виданнях, пов’язаних з діяльністю Редакції
В журналі діє ліцензія CC BY 4.0
