An Adaptive AI-Enhanced Automated Web Security Scanner with Multi-Vector Testing and Vulnerability Chaining
8th International Congress on Human-Computer Interaction, Optimization and Robotic Applications, ICHORA 2026, Ankara, Turkey, 21 - 23 May 2026, (Full Text)
- Publication Type: Conference Paper / Full Text
- Doi Number: 10.1109/ichora69329.2026.11537049
- City: Ankara
- Country: Turkey
- Keywords: Anomaly Scoring, Automated Security Testing, SQL Injection, Vulnerability Chaining, WAF Evasion, Web Application Security, XSS
- Istanbul Gelisim University Affiliated: Yes
Abstract
Modern web applications frequently use layered defenses: Web Application Firewalls (WAFs), rate limiting, and behavior-based Intrusion Detection Systems (IDS). Though conventional automated scanners represent the most cost- effective means of identifying common defects nowadays, they achieve this goal at a grave price: predictability in request patterns, and the use of static payload strategies. This paper describes the concept, the design and the implementation of an adaptive, AI-augmented automated Web security scanning tool for authorized security assessments. In this system the scanner core is multithreaded and its modules divided up according to test type, for searching for anomalies in response patterns over the Internet. It is a closed-loop evasion engine and will turn the encoding of any payload based on live feedback from blocking. It is a vulnerability chaining engine that turns low-level findings into a means to discover higher level exploitable feability holes. Tests against deliberately vulnerable targets have shown that this approach combines significant gains in coverage and prioritization with ethical guards intact - for example scoping, throttling and exclusion is applied as before. The effectiveness of the synthetic data and the simulations suggests the broader conclusion that to create realistic security tests which are actually useful, integrated adaptive behavior with chain-aware reasoning is the key