A Systematic Literature Review on Penetration Testing in Networks: Future Research Directions
Source abstract
Abstract
Given the widespread use of the internet at the individual, governmental, and nongovernmental levels, and the opportunities it offers, such as online shopping, security concerns may arise. Cyber criminals are responsible for stopping organizations’ access to internet, for stealing valuable and confidential data, and causing other damage. Therefore, the network must be protected and meet security requirements. Network penetration testing is a type of security assessment used to find risk areas and vulnerabilities that threaten the security of a network. Thus, network penetration testing is designed to provide prevention and detection controls against attacks in the network. A tester looks for security issues in the network operation, design, or implementation of the particular company or organization. Thus, it is important to identify the vulnerabilities and identify the threats that may exploit them in order to find ways to reduce their dangers.The ports at risk are named and discussed in this study. Furthermore, we discuss the most common tools used for network penetration testing. Moreover, we look at potential attacks and typical remediation strategies that can be used to protect the vulnerable ports by reviewing the related publications. In conclusion, it is recommended that researchers in this field focus on automated network penetration testing. In the future, we will use machine learning in WLAN penetration testing, which provides new insight and high efficiency in performance. Moreover, we will train machine learning models to detect a wide range of vulnerabilities in order to find solutions to mitigate the risks in a short amount of time rather that through manual WLAN penetration testing, which consumes a lot of time. This will lead to improving security and reducing loss prevention.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Network Security and Intrusion Detection · Advanced Malware Detection Techniques · Internet Traffic Analysis and Secure E-voting
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Computer Networks and Communications, CCSIT, King Faisal University, Al-Ahsa 31982, Saudi Arabia
Funding
King Faisal Universit
References (44)
Show source-provided references
1. Adamovic, S. (2019). Sinteza 2019-International Scientific Conference on Information Technology and Data Related Research, Singidunum University.
2. Tidy, J. (2023, May 17). Swedish Coop Supermarkets Shut Due to Us Ransomware Cyber-Attack. Available online: https://www.bbc.com/news/technology-57707530.
3. Shah, M., Ahmed, S., Saeed, K., Junaid, M., and Khan, H. (2019, January 30–31). Penetration testing active reconnaissance phase–optimized port scanning with nmap tool. Proceedings of the IEEE 2019 2nd International Conference on Computing, Mathematics and Engineering Technologies (iCoMET), Sukkur, Pakistan.10.1109/ICOMET.2019.8673520 ↗
4. Jayasuryapal, G., Meher Pranay, P., and Kaur, H. (2021, January 28–30). A Survey on Network Penetration Testing. Proceedings of the IEEE 2021 2nd International Conference on Intelligent Engineering and Management (ICIEM), London, UK.10.1109/ICIEM51511.2021.9445321 ↗
5. (2023, May 06). Packetlabs. Black-Box vs. Grey-Box vs. White-Box Penetration Testing. Available online: https://www.packetlabs.net/posts/types-of-penetration-testing/.
6. Khera, Y., Kumar, D., and Garg, N. (2019, January 14–16). Analysis and Impact of Vulnerability Assessment and Penetration Testing. Proceedings of the IEEE 2019 International Conference on Machine Learning, Big Data, Cloud and Parallel Computing (COMITCon), Faridabad, India.10.1109/COMITCon.2019.8862224 ↗
7. Press, T.A. (2023, May 12). T-Mobile Says Breach Exposed Personal Data of 37 Million Customers. Available online: https://www.npr.org/2023/01/20/1150215382/t-mobile-data-37-million-customers-stolen.
8. Farah, A.-D., and Alshammari, E. (November, January 31). Automated penetration testing: An overview. Proceedings of the 4th International Conference on Natural Language Computing, Copenhagen, Denmark.
9. Kumar, B.K., Raj, N., Dhivvya, J.P., and Muralidharan, D. (2019, January 23–25). Fixing Network Security Vulnerabilities in Local Area Network. Proceedings of the 2019 3rd International Conference on Trends in Electronics and Informatics (ICOEI), Tirunelveli, India.10.1109/ICOEI.2019.8862634 ↗
10. Shebli, A., Mohammed Zaher, H., and Beheshti, B.D. (2018, January 4–8). A study on penetration testing process and tools. Proceedings of the 2018 IEEE Long Island Systems, Applications and Technology Conference (LISAT), Farmingdale, NY, USA.10.1109/LISAT.2018.8378035 ↗
11. Analysis and Evaluation of Wireless Network Security with the Penetration Testing Execution Standard (PTES)
12. Singh, N., Meherhomji, V., and Chandavarkar, B.R. (2020, January 1–3). Automated versus manual approach of web application penetration testing’. Proceedings of the IEEE 2020 11th International Conference on Computing, Communication and Networking Technologies (ICCCNT), Kharagpur, India.10.1109/ICCCNT49239.2020.9225385 ↗
13. Wireless Cyberspace
14. Ethical Hacking of IEEE 802.11 Encryption Protocols
15. Agrawal, A., Chatterjee, U., and Maiti, R.R. (2023). CheckShake: Passively detecting anomaly in Wi-Fi security handshake using gradient boosting based ensemble learning. IEEE Trans. Dependable Secur. Comput., 1–13.10.1109/TDSC.2023.3236355 ↗
16. Hoque, N., Rahbari, H., and Rezendes, C. (2022, January 3–5). Systematically Analyzing Vulnerabilities in the Connection Establishment Phase of Wi-Fi Systems. Proceedings of the 2022 IEEE Conference on Communications and Network Security (CNS), Austin, TX, USA.10.1109/CNS56114.2022.9947252 ↗
17. Experimental Evaluation of Different Penetration Security Levels in Wireless Local Area Network10.12720/jcm.13.12.723-729 ↗
18. Syed, S., Khuhawar, F., Arain, K., Kaimkhani, T., Syed, Z., Sheikh, H., and Khan, S. (2020). Case Study: Intranet Penetration Testing of MUET, Mehran University of Engineering and Technology.
19. Applying vulnerability assessment and penetration testing (vapt) and network enhancement on the network
20. Shi, P., Qin, F., Cheng, R., and Zhu, K. (2019, January 5–7). The penetration testing framework for large-scale network based on network fingerprint. Proceedings of the IEEE 2019 International Conference on Communications, Information System and Computer Engineering (CISCE), Haikou, China.10.1109/CISCE.2019.00089 ↗
21. Patel, A.M., and Patel, H.R. (2019, January 21–23). Analytical study of penetration testing for wireless infrastructure security. Proceedings of the IEEE 2019 International Conference on Wireless Communications Signal Processing and Networking (WiSPNET), Chennai, India.10.1109/WiSPNET45539.2019.9032741 ↗
22. Iyamuremye, B., and Hisato, S. (2018, January 13–17). Network security testing tools for SMEs (small and medium enterprises). Proceedings of the IEEE 2018 International Conference on Applied System Invention (ICASI), Tokyo, Japan.10.1109/ICASI.2018.8394272 ↗
23. Overstreet, D., Wimmer, H., and Haddad, R.J. (2019, January 11–14). Penetration Testing of the Amazon Echo Digital Voice Assistant Using a Denial-ofService Attack. Proceedings of the IEEE 2019 SoutheastCon, Huntsville, AL, USA.10.1109/SoutheastCon42311.2019.9020329 ↗
24. U Nisa, M., and Kashif, K. (2020, January 12–13). Detection of slow port scanning attacks. Proceedings of the IEEE 2020 International Conference on Cyber Warfare and Security (ICCWS), Norfolk, VA, USA.10.1109/ICCWS48432.2020.9292389 ↗
25. Network vulnerability analysis on brain signal/image databases using Nmap and Wireshark tools10.1109/ACCESS.2018.2872775 ↗
26. MikroTik Router Vulnerability Testing for Network Vulnerability Evaluation using Penetration Testing Method
27. Security Analysis of Wireless Local Area Network (WLAN) Network with the Penetration Testing Method
28. Wireless penetration testing method to analyze WPA2-PSK system security and captive portal
29. Kumar, R., and Katlego, T. (2018, January 14–15). Internal network penetration testing using free/open source tools: Network and system administration approach. Proceedings of the International Conference on Advanced Informatics for Computing Research, Shimla, India.10.1007/978-981-13-3143-5_22 ↗
30. Pandey, R., Vutukuru, J., and Chopra, U.K. (2020, January 25–26). Vulnerability assessment and penetration testing: A portable solution Implementation. Proceedings of the IEEE 2020 12th International Conference on Computational Intelligence and Communication Networks (CICN), Bhimtal, India.10.1109/CICN49253.2020.9242640 ↗
31. Liao, S., Zhou, C., Zhao, Y., Zhang, Z., Zhang, C., Gao, Y., and Zhong, G. (2020, January 29–30). A Comprehensive detection approach of Nmap: Principles, rules and experiments. Proceedings of the IEEE 2020 International Conference on Cyber-Enabled Distributed Computing and Knowledge Discovery (CyberC), Chongqing, China.10.1109/CyberC49757.2020.00020 ↗
32. Ernawati, T., Fachrozi, M.F., and Syaputri, D.D. (2019). IOP Conference Series: Materials Science and Engineering, IOP Publishing.
33. Hartpence, B., and Kwasinski, A. (2020, January 17–20). Combating TCP port scan attacks using sequential neural networks. Proceedings of the IEEE 2020 International Conference on Computing, Networking and Communications (ICNC), Big Island, HI, USA.10.1109/ICNC47757.2020.9049730 ↗
34. Mitigation of dos and port scan attacks using snort
35. Neu, C.V., Tatsch, C.G., Lunardi, R.C., Michelin, R.A., Orozco, A.M., and Zorzo, A.F. (2018, January 23–27). Lightweight IPS for port scan in OpenFlow SDN networks. Proceedings of the IEEE NOMS 2018—2018 IEEE/IFIP Network Operations and Management Symposium, Taipei, Taiwan.10.1109/NOMS.2018.8406313 ↗
36. Wu, D., Gao, D., Chang, R.K., He, E., Cheng, E.K., and Deng, R.H. (2019, January 24–27). Understanding open ports in Android applications: Discovery, diagnosis, and security assessment. Proceedings of the Network and Distributed System Security Symposium 26th NDSS 2019, San Diego, CA, USA.10.14722/ndss.2019.23171 ↗
37. Luswata, J., Zavarsky, P., Swar, B., and Zvabva, D. (2018, January 6–7). Analysis of scada security using penetration testing: A case study on modbus tcp protocol. Proceedings of the IEEE 2018 29th Biennial Symposium on Communications (BSC), Toronto, ON, Canada.10.1109/BSC.2018.8494686 ↗
38. Server Stress Test Using DDoS Attack
39. Chaudhary, S., O’Brien, A., and Xu, S. (July, January 29). Automated post-breach penetration testing through reinforcement learning. Proceedings of the 2020 IEEE Conference on Communications and Network Security (CNS), Avignon, France.10.1109/CNS48642.2020.9162301 ↗
40. Hu, Z., Beuran, R., and Tan, Y. (2020, January 7–11). Automated penetration testing using deep reinforcement learning. Proceedings of the 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW), Genoa, Italy.10.1109/EuroSPW51379.2020.00010 ↗
41. Niculae, S., Dichiu, D., Yang, K., and Bäck, T. (2020). Automating Penetration Testing Using Reinforcement Learning, Experimental Research Unit Bitdefender.
42. Hierarchical reinforcement learning for efficient and effective automated penetration testing of large networks10.1007/s10844-022-00738-0 ↗
43. Simulating SQL injection vulnerability exploitation using Q-learning reinforcement learning agents
44. Securezy—A Penetration Testing Toolbox