A Zero-Day Vulnerability Detection and Automated Security Assessment Framework
Keywords:
Analyzing, Automated OWASP Top 10, Framework, Security assessment, Security framework, Vulnerability framework, Vulnerability scoring, Zero-day detectionAbstract
The increasing dependence on digital systems, software applications, cloud storage, and digital infrastructure has intensified cybersecurity risks, particularly those associated with previously unknown or undocumented vulnerabilities. This study aims to propose a Zero-Day Vulnerability Detection and Automated Security Assessment Framework for identifying potential unknown security weaknesses, evaluating their severity, and recommending appropriate mitigation measures. The proposed framework adopts a Vulnerability Assessment and Penetration Testing (VAPT) methodology that integrates asset discovery, vulnerability assessment, vulnerability classification, controlled validation, behavioural analysis, risk prioritization, remediation, and reassessment. Identified vulnerabilities are correlated with established security references, including Common Vulnerabilities and Exposures (CVE), Common Weakness Enumeration (CWE), Common Vulnerability Scoring System (CVSS), and the OWASP Top 10. Furthermore, the framework supports security-control mapping to relevant standards and compliance frameworks, including NIST, ISO/IEC 27001, and HIPAA. Findings that do not correspond to existing vulnerability records undergo additional behavioural analysis and validation to determine whether they represent potential zero-day vulnerabilities. The proposed framework establishes an integrated workflow for vulnerability identification, risk-based classification, and automated remediation guidance. Its expected outcomes include improved assessment consistency, more effective vulnerability prioritization, and reduced false-positive classification through controlled validation and reassessment. Experimental evaluation using measurable indicators, including detection accuracy, false-positive rate, and remediation effectiveness, is required to determine the framework’s actual performance.
References
OWASP Foundation, “OWASP Top 10:2021,” 2021.
ISO/IEC, Information Security, Cybersecurity and Privacy Protection—Information Security Management Systems—Requirements, ISO/IEC 27001:2022, 3rd ed., Oct. 2022.
M. Souppaya and K. Scarfone, Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology, NIST Special Publication 800-40 Rev. 4, National Institute of Standards and Technology, Gaithersburg, MD, USA, Apr. 2022
Y. Guo, “A review of machine learning-based zero-day attack detection: Challenges and future directions,” Computer Communications, vol. 198, pp. 175–185, Jan. 2023.
L. Yee Por et al., “A systematic literature review on AI-based methods and challenges in detecting zero-day attacks,” in IEEE Access, vol. 12, pp. 144150–144163, Sept. 2024.
C. Pascoe, S. Quinn, and K. Scarfone, The NIST Cybersecurity Framework (CSF) 2.0, NIST Cybersecurity White Paper CSWP 29, National Institute of Standards and Technology, Gaithersburg, MD, USA, Feb. 2024.
Cybersecurity and Infrastructure Security Agency (CISA), “Known exploited vulnerabilities catalog,” U.S. Department of Homeland Security, JSON Schema, 09-Feb-2026.
F. El Husseini, H. Noura, O. Salman and A. Chehab, “Advanced machine learning approaches for zero-day attack detection: A review,” 2024 8th Cyber Security in Networking Conference (CSNet), Paris, France, 2024, pp. 297–304.
J. M. Franklin, C. W. Wergin, and H. Booth, “CVSS implementation guidance,” NIST Interagency/Internal Report NISTIR 7946, National Institute of Standards and Technology, Gaithersburg, MD, USA, Apr. 2014.
Y. Jia, H. Zhuang, Z. Lin and Y. Meng, “Machine learning for software vulnerability analysis: A survey,” 2021 IEEE Sixth International Conference on Data Science in Cyberspace (DSC), Shenzhen, China, 2021, pp. 396–402.
K. Scarfone, M. Souppaya, A. Cody, and A. Orebaugh, Technical Guide to Information Security Testing and Assessment, NIST Special Publication 800-115, National Institute of Standards and Technology, Gaithersburg, MD, USA, Sep. 2008.
G. Lin, S. Wen, Q. -L. Han, J. Zhang and Y. Xiang, “Software vulnerability detection using deep neural networks: A survey,” in Proceedings of the IEEE, vol. 108, no. 10, pp. 1825–1848, Oct. 2020.
D. Bassi and H. Singh, “A systematic literature review on software vulnerability prediction models,” in IEEE Access, vol. 11, pp. 110289–110311, Sept. 2023.
A. Zhang, Y. Zhang, Y. Xu, C. Wang and S. Li, “Machine learning-based fuzz testing techniques: A survey,” in IEEE Access, vol. 12, pp. 14437–14454, 2024.
MITRE, “CWE list, version 4.20,” Common Weakness Enumeration (CWE), Nov. 19, 2024.
Forum of Incident Response and Security Teams (FIRST), Common Vulnerability Scoring System Version 4.0: Specification Document, ver. 1.2, Jun. 18, 2024.
