Mobile Application Penetration Testing Framework using Data Fusion

The rise of mobile applications has brought about significant security challenges, making thorough security testing an essential element of the development process. While manual penetration tests offer in-depth assessments, they require considerable resources and are difficult to scale. Existing automated tools generally operate in isolation, focusing either on static or dynamic analysis, which leads to an incomplete insight into an application's security condition. This paper presents the Mobile Application Penetration Testing Framework (MAPTF), an innovative, integrated solution aimed at automating and enhancing the security evaluation of Android applications. MAPTF utilizes a hybrid approach, merging static analysis (SAST), dynamic analysis (DAST), and network traffic analysis within a single, web-based infrastructure. It coordinates a collection of specialized tools, such as APKiD, Frida, and OWASP ZAP, to execute a thorough analysis. Significant features of this framework include a data fusion engine that aggregates findings from various sources, a heuristic-based risk scoring system that quantifies the security posture, and the automated creation of detailed, actionable reports. By incorporating multiple analytical methods, MAPTF offers a comprehensive and user-friendly platform for developers and security professionals to effectively identify and address vulnerabilities.