The threat landscape for modern web applications is constantly changing, and traditional security approaches struggle with comprehensive vulnerability detection. Black-box testing, although widely adopted, suffers from limited path coverage and static payload limitations. Model-Based Testing (MBT) provides systematic exploration but requires substantial effort and may miss implementation-specific vulnerabilities. This research introduces and validates a hybrid methodology that integrates black-box testing and MBT through a six-level enhancement framework incorporating authentication mechanisms, client-side crawling, custom payload optimisation, and scope refinement. To demonstrate practical implementation and validate theoretical foundations, the methodology was applied as a case study using OWASP Zed Attack Proxy (ZAP) against OWASP Juice Shop, with manual verification of 3 discovered vulnerabilities and detailed statistical analysis across multiple test iterations. The results demonstrate substantial improvements in vulnerability detection effectiveness, with strong statistical evidence. The case study implementation revealed critical tool reliability issues requiring organisational attention, including systematic documentation of interface reporting discrepancies within automated scanners affecting vulnerability count accuracy, necessitating multi-verification approaches for organisational security assessment. The research contributes (1) a systematic integration framework, designed around tool-agnostic principles and validated through a single-tool case study, enabling incremental adoption across diverse security testing platforms, (2) a comprehensive empirical validation methodology with statistical rigour, and (3) practical implementation guidance including reproducible automation scripts adaptable to various organisational contexts. The framework’s design principles and progressive enhancement approach provide a foundation for broader adoption beyond the specific ZAP implementation demonstrated in this validation study. The sixth level achieved a detection rate of 23.7 critical vulnerabilities compared to 2 critical vulnerabilities in baseline testing, representing a 1085 n=3 iterations per configuration; reported as exploratory rather than confirmatory). Total vulnerability detection increased from 583 to 4427, a 659
Machine learning-based Network Intrusion Detection Systems (NIDS) remain highly vulnerable to test-time evasion (TTE) attacks, yet existing research relies heavily on legacy datasets and ignores the impact of evaluation scale. This study presents a systematic evaluation of TTE attacks using the Adversarial Robustness Toolbox (ART) across three modern, domain-diverse datasets: UNR-IDD, CICIOMT-2024, and UAV-IDS-2025. We evaluate a PyTorch-based fully connected neural network classifier and a 1D Convolutional Neural Network (CNN)-based classifier against white-box (AutoAttack, Auto-PGD, Carlini Wagner) and black-box (HopSkipJump) threat models. Furthermore, we present a scalability analysis by evaluating performance across incremental test-set proportions from 10 to 100
Large language model (LLM) agents increasingly automate offensive-security tasks, but success on isolated challenges does not establish reliable long-horizon autonomy. We study this distinction in authorized capture-the-flag (CTF) and wargame environments and introduce a planner-directed architecture in which a persistent non-executing planner delegates on demand to transient, context-isolated specialists with retrievable skills, persistent execution, compact memory, guardrails, and configurable model escalation. On all 200 challenges of the NYU CTF Bench test split, the system obtains 41 accepted flags (20.5 p = 8× 10^-6 ), no architecture main effect (OR 1.17, p = 0.34 ), and a significant architecture-by-escalation interaction (OR 0.53, p = 0.005 ). Under the spend-constrained 340-action ceiling, the coordination cost of specialist delegation, context restart, and evidence folding offsets any additional solve-rate advantage from the planner-directed structure. On OverTheWire Bandit, the planner-directed system reaches 30/33 standalone and 24/33 sequentially, compared with 27/33 and 23/33 for the strongest single-agent mini backbone.
Nowadays, websites employ multiple tracking mechanisms to personalize user experiences and deliver targeted advertisements. While cookies remain the dominant tracking tool, recent trends indicate an increasing adoption of stateless fingerprinting based on JavaScript methods. However, existing studies often focus on specific tracking technologies, while detailed analyses that jointly examine multiple stateful and stateless tracking mechanisms remain limited. To address this gap, we enhanced OpenWPM-Data-Analytics to improve the detection of fingerprinting mechanisms in scans performed with OpenWPM, a widely used framework for web privacy measurement studies. Using this enhanced measurement and analysis pipeline, we conducted an empirical analysis of the top 1000 most-visited websites, jointly examining cookies, web storage, web analytics tools, and browser fingerprinting techniques. The results show that stateful tracking methods such as cookies and web storage remain highly prevalent. However, fingerprinting techniques were detected on nearly one third of the analyzed websites, with JavaScript Enumeration and WebGL being the most common mechanisms. This prevalence is higher than that reported in previous automated studies, suggesting a growing reliance on fingerprinting as third-party cookies face increasing restrictions. In addition, web analytics tools were present in half of the websites analyzed. These findings highlight the growing complexity of modern web tracking and the need to improve current detection and mitigation strategies, particularly against fingerprinting mechanisms that are more difficult to block and regulate.
Distributed Denial of Service (DDoS) attacks remain among the most serious threats to Software-Defined Networks (SDNs), where centralised control makes timely detection essential. This paper presents a leakage-controlled comparison of six supervised classifiers, namely Logistic Regression (LR), Support Vector Machine (SVM), K-Nearest Neighbours (KNN), Decision Tree (DT), Random Forest (RF) and Extreme Gradient Boosting (XGBoost), and quantifies the effect of Mutual Information (MI) feature selection on detection performance and computational cost. Two open datasets are used: DDoS-SDN (104,345 flow records, binary) and APA-DDoS (151,200 packet records; benign, DDoS-ACK and DDoS-PSH-ACK). All preprocessing and feature selection are fitted on training data only, and models are evaluated on a stratified held-out test set using accuracy, precision, recall, specificity, F1-score, ROC-AUC and PR-AUC, supported by ten-fold cross-validation, McNemar tests with Holm correction and repeated timing. On DDoS-SDN with all 19 behavioural features, XGBoost reaches 100
