Fuzzy Classification Metrics for Scanner Assessment and Vulnerability Reporting

In information security, web application scanners detect and provide some diagnoses for specific vulnerabilities. However, scanner performance as well as the damage potential of different vulnerabilities varies. This undermines the development of effective remediation solutions and the reliable sharing of vulnerability information. This paper describes an approach based on soft computing technology for the development of metrics that are used to grade web application scanners and vulnerabilities so that scanner performance can be evaluated and confidence levels can be computed for vulnerability reports. These metrics help derive a level of assurance that will support security management decisions, enhance effective remediation efforts, and could serve as security tool design metrics.