Automated Vulnerability Detection and Classification using Adaptive Machine Learning

As web platforms became central to daily operations, they also became easy targets for attacks that expose sensitive data and reduce user trust. The Automated Web Application Vulnerability Detection System addresses this by unifying crawling, fuzzing, and feature-based classification. The system scans the given URL, identifies input points, and injects OWASP-based test payloads for issues like SQLi, XSS, and CSRF. It observes the application’s responses in real time, extracts indicators such as errors, latency, and payload behaviour, and classifies them using an Adaptive Random Forest to determine vulnerability type and severity. A final report lists affected fields, risk levels, and mitigation steps. This automated approach reduces the need for manual penetration testing and offers a cost-effective, scalable solution, especially for small and medium businesses. It also supports broader digital-security goals by strengthening infrastructure, enhancing online safety, and helping organizations reduce losses from cyberattacks.

[1]     OWASP Foundation, “OWASP Top Ten Web Application Security Risks,” 2023. [2]     A. Zhang, Y. Zhang, Y. Xu, C. Wang, and S. Li, “Machine learning- based fuzz testing techniques: A survey,” IEEE Access, vol. 12, pp. 151380–151399, 2024. [3]     B. Pejsˇ and N. Kapui, “SQLi detection with machine learning: A data- source perspective,” in Proc. 20th Int. Conf. Security and Cryptography (SECRYPT), 2023, pp. 642–648. [4]     C. Wang, W. Meng, C. Luo, and P. Li, “Predator: Directed web application fuzzing for efficient vulnerability validation,” in Proc. IEEE Symposium on Security and Privacy (SP), San Francisco, USA, 2025. [5]     F. Ali and K. Rahman, “Detecting advanced cross-site scripting attacks using classical machine-learning models,” Applied Computing Review, vol. 10, no. 1, pp. 12–20, 2025. [6]     S. K. Shukla and P. Patel, “Machine-learning-based detection of injection attacks in web applications,” Computers & Security, vol. 126, pp. 102– 118, Elsevier, 2023. [7]     I. P. A. Dharmaadi, E. Athanasopoulos, and F. Turkmen, “Fuzzing frameworks for server-side web applications: A survey,” International Journal of Information Security, vol. 24, pp. 197–220, Springer, 2025. [8]     J. Lee and K. Park, “Automated web vulnerability scanning: A systematic review,” Future Generation Computer Systems, Elsevier, vol. 152, pp. 450–466, 2024. [9]     L. Wang and Z. Cheng, “Machine learning approaches for web vulnerability detection,” IEEE Transactions on Dependable and Secure Computing, vol. 19, no. 3, pp. 1450–1464, 2022. [10]    R. Sharma and P. Singh, “Machine learning approaches for automated vulnerability detection in web applications,” Journal of Network and Applications, vol. 16, no. 1, pp. 1–12, 2025.