# Bridging the Gap: A Survey and Classification of Research-Informed Ethical Hacking Tools
## 5 Classification
### Knowledge-Based Classification: NCSC CyBOK and ACM CCS  
Table A4 presents the classification of tools according to NCSC CyBOK. The distribution of tools across different _Knowledge Areas_ (KAs) reflects the range of cybersecurity domains and disciplines covered by penetration testing activities. From the categorisation in Table 3, it is evident that certain areas, such as _Software and Platform Security_ and _Networks Security_, are unsurprisingly more prominent, indicating areas of emphasis within cybersecurity practice. It should also be noted that while each category addresses specific aspects of cybersecurity, many tools may span multiple categories. Most of the tools are classified under _Software and Platform Security: Software Security: Detection of Vulnerabilities_ (57 tools), which is a subcategory of _Software and Platform Security: Software Security_. The significant number of tools in this area reflects the recognition of software as a primary attack vector and demonstrates the research community's effort. Moreover, 38 tools are classified in the _Software and Platform Security: Web and Mobile Security_ subcategory, highlighting the research work conducted to address the challenges posed by the development and deployment of web and mobile applications. The 26 tools falling under _Infrastructure Security: Network Security_ demonstrate the academic efforts in this area, ranging from network traffic monitoring and anomaly detection to implementing robust encryption protocols. Nine tools classified under the _Attacks and Defences: Adversarial Behaviours_ subcategory indicate research aimed at understanding and simulating the techniques used by attackers. Among the various categories within the ACM CCS, EH tools in Table A5 predominantly fall into the _Security and Privacy_ root category, specifically within the subcategories of _Systems Security_, _Software and Application Security_, and _Network Security_. In general, ACM CSS categories are too coarse to capture certain peculiarities of the tools. As CyBOK is specific to \begin{table}
\begin{tabular}{l r} \hline \hline _CyBOK Knowledge Area_ & **No.** \\ \hline Software and Platform Security: Software Security & 77 \\ Software and Platform Security: Web and Mobile Security & 38 \\ Infrastructure Security: Network Security & 26 \\ Attacks and Defences: Adversarial Behaviours & 9 \\ Systems Security: Authentication, Authorisation and Accountability & 9 \\ Systems Security: Distributed Systems Security & 3 \\ Infrastructure Security: Applied Cryptography & 2 \\ Human, Organisational and Regulatory Aspects: Human Factors & 2 \\ Attacks and Defences: Malware and Attack Technology & 1 \\ Infrastructure Security: Physical Layer and Telecommunications Security & 1 \\ Human, Organisational and Regulatory Aspects: Privacy and Online Rights & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Number of tools identified according to CyBOK, for KAs with at least one tool. cybersecurity, it is more granular than ACM CSS for our purpose. We discuss the limitations in the classification in Section 5.4. Software And Application Security: Vulnerability Management: Vulnerability Scanners has the highest number of tools at 73. This indicates the proactive measures the research community is taking to detect various issues, from misconfigurations and missing patches to software flaws and weak passwords. The categorisation of 35 tools under the _Software and Application Security: Web Applications Security_ subcategory highlights the focus on developing specialised tools designed to test and secure web applications. These tools analyse web applications for vulnerabilities like SQL injection, cross-site scripting (XSS), and security misconfigurations. Twenty-two tools were categorised under the _Network Security_ domain and subdomains, focusing on protecting the data during its transmission across networks.