Design and Implementation of Distributed Web Application Vulnerability Assessment Tools for Securing Complex Microservices Environment

2.1 Complex environment

Complex applications are structured unit with reusable components and independent services that operate the functionalities individually [10]. With this result, the individual model system provides a highly interdependent for each component. Another opportunity of implementing web application that already apply reusable component and independent services are the ability to implement a heterogeneous technology stack on the web application instead using a relatively fixed stack for every component. The advantages of heterogeneous technology stacks are easiness for supply of library and a huge possibility for innovation by different developer with their own known technologies. In addition of these opportunities in the complex environment, deploying microservices in the complex environment does not need a control of entire system since microservices are deployed independently.

As the web applications become more dynamic, the infrastructure was following up with the complexity of the system itself. This means infrastructure security models such as perimeter-based security that only focus on their local boundaries network are no longer effective [11]. It requires a shift of architecture model that had an ability of continuous security monitoring in their model, which able by adopting the Zero-Trust Architecture (ZTA) model [12]. In the ZTA architecture model, each component in the systems is considered as untrustworthy until verified. To support these challenges, ZTA require a security orchestration that manage the modern complex system including continuous monitoring system in real-time and vulnerability assessment to analyze the weakness [13].

2.2 Vulnerability assessment

Vulnerability assessment (VA) is a process to identify and classify weaknesses in a system or infrastructure [14]. The objective of performing VA in the system is to provide insight of the security posture and measure appropriate mitigation or elimination of the risks [15]. Performing VA in your system is applied by scanning various assets, such as servers, web applications, database, and network components for possible vulnerabilities. This performance is using both automated and manual techniques to evaluate the system [16]. The automated techniques are providing efficiency by rapidly detecting common vulnerabilities across the systems [17]. For the manual techniques, it offers a deeper and more detailed analyses for more complex issue rather than automated findings. Therefore, combining these two methods performs a comprehensive security evaluation throughout the complex system.

Table 1. Current vulnerability detection accuracy results

The previous research [18] provides a comparative results of various security vulnerability scanning tools systematically compiled from various scientific article based on its evaluation result on the OWASP framework, that ranks the 10 most critical vulnerabilities. The research results mention SQL Injection and XSS vulnerabilities often reported in the articles as shown in Table 1.

The various scientific articles discussed show that five open-source-based Web Vulnerability Scanners (WVS) are majorly focused on only 2 types of vulnerabilities, Injection and XSS. Therefore, in the web application with complex system, it necessary to evaluate the capabilities of WVS to be able to expand the scope of scanning into other types of vulnerability. To solve this, this study aims to reach other scopes such as Security Misconfiguration, Vulnerable Components, and Sensitive Data Exposure.

2.3 OWASP framework

As system become complex, ensuring a standard security posture across applications becomes a critical challenge. For web-based applications, various framework establishes standards for assessing security weaknesses that serve as essential references for organization aiming to enhance their vulnerability assessment practices [19]. OWASP is an industry standard that address this challenge by providing a widely accepted list of critical vulnerabilities monitor in the OWASP Top 10 [20]. These standards guide developers and security practitioners in identifying and mitigating security risks, helping maintain robust security even as application grow in complexity. OWASP framework is designed to accommodate diverse configuration, making it suitable for complex environments that require consistent security measures.

2.4 Multi-agent system in distributed architecture

Multi-agent system is a system design approach that separate services in to multiple nodes or agent which able to work independently [21]. In the Distributed Architecture, this system generates a more efficient and scalable process in the context of VA. These advantages leverage the problem in centralize monitoring system where a single point of failure vulnerability exists by distributing the responsible for VA into multiple agents across the network. The challenge in implementing his multi-agent system is to ensure each scenario and interaction between the agent and the central system to be performed as scheduled.

2.5 F-Measure method

The F-Measure method is a metric to assess the performance of the classification system, particularly in contexts where there is an imbalance between positive and negative outcomes [22]. In this context, the classification of the vulnerability that found during VA, had an imbalance positive and negative cases as the result. The F-Measure calculate the precision and recall from The VA result, and accumulate it to become the overall accuracy using F1-Score. The precision identifies True Positive (TP) vulnerabilities compared with all detections, including the False Positive (FP), as shown in Eq. (1).

Precision $=\frac{T P}{T P+F P}$         (1)

The recall is a proportion of actual vulnerabilities that are correctly identified by the VA tools, including the False Negative (FN) as shown in Eq. (2).

Recall $=\frac{T P}{T P+F N}$               (2)

In this context, there are two goals that should be achieved by avoiding FP (irrelevant alerts) and minimizing FN (missed vulnerabilities). With the F1-Score, these objectives are measured, using the precision and recall rather each of the scores are high or low. The formulation of F-Measure to calculate the F1-Score is shown in Eq. (3).

F1-Score $=2 \times \frac{Precision \times Recall}{Precision+ Recall}$            (3)

F-Measure provides evaluation of the detection in each scanning node using different tools. It helps assess the consistency across multiple nodes by measuring how well the system balances the precision and recall.

4.1 System detection accuracy

The experiment was conducted by scanning using Nuclei vulnerability scanner with 5 iterations for each agent. This iteration was performed to ensure the results were stable within the subjects. From the results, the found vulnerabilities are compared with the ground truth that already defined, and calculate each vulnerability results using the F-Measure method as shown in Table 2.

From the results in Table 4, indicates that the Nuclei vulnerability scanner demonstrates high detection accuracy for Injection with 80% accuracy, XSS with 85.71% accuracy, and Sensitive Data Exposure with 90.91% accuracy. While showing moderate accuracy for Security Misconfiguration and Vulnerable Components with 50% accuracy. Comparing with other tools [18], Nuclei outperforms by covering five vulnerability types instead of only Injection and XSS. The broader scope and balanced precision and recall performance highlight its effectiveness in diverse scenarios. For overall detection accuracy results are shown in Table 5.

Comparing with overall results of previous research, the Nuclei Scanner demonstrates broader vulnerability coverage and higher accuracy in several scopes. While its Injection accuracy only achieve 80% which lower than Wapiti with 97% accuracy and Arachni with 98% accuracy, Nuclei matches Vega in XSS detection with 85% accuracy and outperforms other tools in overall scopes. Additionally, Nuclei extends the benchmark by effectively detecting vulnerabilities in more complex categories such as Security Misconfiguration with 80% accuracy, Sensitive Data Exposure with 90.9% accuracy, and Vulnerable Components with 50% accuracy.

Table 4. Nuclei vulnerability scanner accuracy result

Table 5. Overall vulnerability detection accuracy results

Nuclei outperforms other vulnerability scanning tools due to its unique combination of speed, customizability, and community-driven template system. Its high-performance engine enables rapid scanning across various protocols, including TCP, SSH, DNS, HTTP, and SSL, facilitating efficient large-scale assessments. The use of simple YAML-based templates allows users to define custom detection scenarios, enhancing flexibility and enabling tailored scans to meet specific requirements. Additionally, Nuclei's active open-source community contributes to a continually updated repository of over 8,000 templates, ensuring timely detection of emerging vulnerabilities. This collaborative approach, combined with its modular architecture, allows Nuclei to adapt to a wide range of needs, making it a preferred choice for comprehensive and up-to-date vulnerability assessments.

4.2 Distributed architecture implementation

The DVMS architecture directly addresses the single point of failure limitation inherent in centralized vulnerability management systems through its distributed, multi-agent design. In the implementation of Distributed Architecture, it maintains the current process to be stable while the multi-agent systems are scaled horizontally. This solution ensures the system relies on continuous monitoring while still monitoring the central dashboard. As illustrated in the Figure 3, through this approach, DVMS topology optimizes detection accuracy in complex environments.

3.png

Figure 3. The network topology of DVMS

4.png

Figure 4. Architecture design of DVMS assessment agent

In the distributed architecture, the agent is scaled horizontally without affecting other components in the architecture [25]. With the ability to specifically scan a part of the system, it enhances the performance of accuracy in each system with their parallel processing. In Figure 4, the DVMS agent architecture has four main processes that work in parallel, so the process is performed simultaneously without interrupting any other child process.

Job Requester

This process retrieves the schedule for the task from the central management system. If any asset is scheduled for imminent scanning, the job requester accepts the task and store it temporary in the agent Redis database.

Vulnerability Assessment

This process uses the Nuclei VA tools to perform the vulnerability scan. It processes only the tasks stored in temporary storage, executing scans based on the predefined schedule.

Reporter

Once the vulnerability scan is complete, this process reports the assessment results to the central system for aggregation and analysis.

Monitoring

This independent process monitors the computational performance of the entire agent, ensuring optimal resource utilization and preventing potential bottlenecks.

After this process, each report and process monitoring are sent to the central management system for data aggregation and managing the result into the central dashboard that enables the administrator to respond to threats effectively. The central management dashboard is able to assign the VA tasks to the suitable agent using a task scheduling algorithm. This algorithm ensures every agent receives tasks based on its current workload and latency within the network. When the central management system identifies the asset needs assessment from the time defined by the users, it allocates the tasks in to the agents immediately.