-
-
starting view
-
dashboard
-
To upload domain
-
process
-
process ends
-
output document or report for download
Inspiration
Modern websites are reliant on numerous technologies, services, and configurations, and assessing their security manually is a challenging task. Multiple security tools help with identifying potential weaknesses, but each tool focuses on specific areas of security, and the information has to be gathered and evaluated separately.
Inspired by the importance of website security, we decided to design CyberResilience, an autonomous AI web security assessment system that combines various security assessment tools and methods. Our idea is to simplify the security assessment and allow users to obtain a complete understanding of the security of a website through an automated and consolidated analysis.
What We Built
CyberResilience is a system that takes a given authorized website address as an input, scans it using multiple security tools, processes the information, and compiles the results into a unified report.
The system uses such popular open-source vulnerability scanners as Nmap, Nikto, Wapiti, SQLMap, Gobuster, and Technology Fingerprinting. These tools allow detecting common vulnerabilities and weaknesses, such as open ports, web server flaws, weaknesses in web applications, directory structure analysis, SQL injections, and others.
The data collected from different vulnerability scanners is compiled into a single report, which includes information normalization, duplication removal, vulnerability classification, risk assessment, correlation, etc.
AI and Autonomous Approach
Our initial idea was to create a system that could go beyond basic security assessment commands. CyberResilience is designed as an autonomous AI system that employs a security assessment loop. In other words, the system takes action based on the information it collects, such as autonomously scanning a website, analyzing the data, and providing high-level suggestions and risk assessments.
AI can be applied to analyze results from different scanners, explain and categorize security-related issues, and suggest possible solutions in order to make the analysis more approachable to non-specialists. Thus, CyberResilience can be used both by cybersecurity specialists and regular developers.
How We Built It
The system consists of a backend built with Python and FastAPI and separate scanner modules. The general idea was to build a system that follows the standard security assessment loop: website address → technology identification → security scanning → report generation.
The scanning process involves running the vulnerability scanners described above, collecting, processing, and analyzing the data. In terms of technical implementation, the system relies on a separate scanner environment, which is organized through containerization.
The technical part of the project is not the focus; instead, we tried to emphasize the concept of combining multiple website security assessment tools into a single system.
What We Learned
We learned a lot while building CyberResilience. First of all, we discovered that building a system that relies on multiple independent security assessment tools is more complex than just running nmap or other similar scanners. Every vulnerability scanner has its own set of instructions and requirements, and there is a learning curve that is needed to be able to run these tools.
Moreover, we had to figure out how to process the data, since every tool uses a different data structure, which had to be normalized before being compiled into a unified report. We also learned about the main aspects of website security, such as web application protection, port scanning, vulnerability assessment, technology fingerprint identification, and much more.
While creating the prototype of an autonomous AI website scanner, we also learned about the concepts of autonomous security assessment, API development, unit testing, and website report generation.
Finally, while working on the project, we discovered that it is not possible for an automated system to claim that a website is secure based on scanning results. The reason for this is that such systems can only detect known issues and flaws, whereas unidentified threats still pose a danger.
Challenges
One of the main challenges we had to overcome while building CyberResilience was to adapt different security assessment tools to work together. The issue was that the tools had different requirements, commands, and ways of processing data.
Another challenge was to deal with the issue of false negatives, i.e., situations when a scanner does not detect a vulnerability, while, in reality, it should have. In other words, scanners can sometimes produce misleading results, and the system has to be able to identify them rather than listing them as secure areas.
Finally, it was also a challenge to process and visualize the data and make it easy to understand for the user, both for cybersecurity specialists and regular developers.
A possible solution to the first challenge was to develop a separate scanner environment, which allowed us to isolate the tools and work with them individually. As for misleading scan results, we tried to address this issue by acknowledging these results separately from actual results rather than including false negatives with real vulnerabilities in the general list of detected issues.
Log in or sign up for Devpost to join the conversation.