Holistic Web Application Security Visualization for Multi-Project and Multi-Phase Dynamic Application Security Test Results

Ferda Özdemir Sönmez

doi:10.1109/ACCESS.2021.3057044

2021-01-01

Ferda Özdemir Sönmez *

Banu Günel

DOI：10.1109/ACCESS.2021.3057044

原文链接

查看原文

摘要

En 中文

As the number of web applications and the corresponding number and sophistication of the threats increases, creating new tools that are efficient and accessible becomes essential. Although there is much research concentrating on network security visualizations, there are only a few studies considering the web application vulnerabilities' possible visualization options. Consequently, to fill this gap, this research centers around a novel perception configuration to improve web application vulnerability monitoring. This study forms a generic data structure based on data sources that might be readily associated and commonly available for the majority of the web applications. The primary contribution of this study is a new dashboard tool for visualizing dynamic application security test results. Another contribution is the metrics/measures that the tool presents. The paper also describes a validation study in which participants answered quiz questions upon using the tool prototype. For the case study, sample data has been generated using the OWASP ZAP scanner tool and a prototype has been implemented to be used for validation purposes. This study allows the investigation of fifty metrics/measures for the multi-project/phase environment that enhances its benefits if the user aims to monitor a series of analyses' results and the changes between them for more than one web project.

Keyword:

Tools

Security

Data visualization

Software

Application security

Prototypes

Monitoring

Computer security

information security

visualization

software engineering