A Minimal Security Benchmark for Web Vulnerability Detection

This project develops a small, reproducible benchmark for comparing web application security testing tools in a controlled educational environment. It uses a deliberately vulnerable demonstration application with a limited set of clearly documented test cases, such as SQL injection and cross-site scripting. Each case has a known expected outcome, allowing results from selected static or dynamic analysis tools to be recorded consistently. The project explains how to calculate basic detection metrics, including precision, recall, and F1-score, and presents the findings in a concise report. All testing is restricted to the local benchmark application; no real websites, personal data, or unauthorized systems are involved.

Идея

Use a deliberately vulnerable local application with labeled test cases and known outcomes to show, in a repeatable way, how security tools identify selected vulnerability types and where they produce missed or incorrect findings.

Продукт

A concise benchmark package consisting of a documented local test plan, a small labeled set of safe demonstration cases, a results table, metric calculations (precision, recall, and F1-score), and a user guide explaining how to reproduce the comparison. The package must be limited to authorized local testing and must not provide instructions for attacking third-party systems.

Проблема

Security tool results can be difficult to compare because tools may use different configurations, test targets, and reporting conventions. A small benchmark with known outcomes helps learners understand performance measures and false alarms without testing real systems.

Актуальность

In 2026, software teams and learners continue to rely on automated tools to identify application vulnerabilities, but results vary across tools and configurations. A small controlled benchmark builds practical understanding of reliable comparison, false positives, and missed findings while reinforcing the requirement to test only systems for which authorization has been granted.

Цель

Create and document a minimal, safe, reproducible benchmark that demonstrates how to compare the detection performance of web security testing tools.

Задачи

Review benchmark and application-security concepts; define a small set of controlled vulnerability test cases; prepare or select a locally run demonstration application; choose suitable testing tools and configure them safely; record expected and observed results; calculate confusion-matrix metrics; interpret limitations; produce a concise benchmark report and usage guide.

Ресурсы

Material resources: computer capable of running a local demonstration application and selected security tools, development environment, benchmark documentation, and spreadsheet or simple analysis software. Time: approximately 3–4 weeks for background research, setup, controlled test runs, metric calculation, and report preparation.

Роли в проекте

Project coordinator and researcher; application and test-case curator; tool operator; results analyst; report editor

Целевая аудитория

Students studying cybersecurity or software engineering, teachers, and beginner security practitioners working in authorized lab environments.

Предпросмотр документа

Наименование образовательного учреждения

Выполнил:ФИО

Руководитель:ФИО

Содержание

Introduction

Security Testing and Benchmarking Concepts

Scope, Safety, and Evaluation Questions

Selection and Specification of Test Cases

Demonstration Application and Tool Configuration

Controlled Test Procedure and Data Recording

Performance Metrics and Calculation

Results Presentation and Comparative Interpretation

Limitations, Reproducibility, and Educational Use

Conclusion

Bibliography