Benchmarks

WSHawk’s published benchmark suite is designed for repeatable correctness and regression testing. It runs only against synthetic services bound to ephemeral 127.0.0.1 ports. It is not a maximum-throughput, denial-of-service, or internet-scanning benchmark.

Latest Verified Results

PASS: the latest available artifacts in the source checkout record a clean Python benchmark run and a 34/34 Electron + Go authorization result with no false positives or false negatives.

Python Core Benchmark

The Python artifact was generated on July 19, 2026 on Windows 11 AMD64 with CPython 3.12.13. It used one excluded warm-up followed by three measured iterations. All release gates passed with no failed checks.

Benchmark group	Checks per run	Pass rate	Median wall time	P95 wall time
HTTP and web attacks	17	100%	735.46 ms	737.25 ms
WebSocket attacks	7	100%	1,800.94 ms	1,810.42 ms
Paired industry security controls	11	100%	2,162.66 ms	2,198.90 ms
Total	35	100%	—	—

Across the three measured iterations, the runner completed 105 check evaluations without a failed check. Each web run exercised 116 payloads, each WebSocket run exercised 12 frames, and each industry-control run evaluated 11 paired vulnerable-versus-hardened assertions.

Electron + Go Authorization Benchmark

The WSHawk 4.0.4 artifact was generated on July 23, 2026 against the owned loopback authorization lab.

Result	Observed value
Scenarios passed	34/34
True positives / true negatives	17 / 17
False positives / false negatives	0 / 0
Precision / recall	1.00 / 1.00
HTTP / GraphQL / WebSocket scenarios	28 / 2 / 4
Network requests	326
Mean / P95 scenario latency	56 ms / 122 ms
Worker heap delta	13.34 MiB
Encrypted project database	Passed
Finding-management workflow	Passed

State-changing scenarios used bounded execution and verified rollback. The run also exercised duplicate consolidation, finding edits, retest classifications, and selected JSON, Markdown, and CSV exports.

Machine-Readable Evidence

• Download the Python benchmark artifact — SHA-256 4c4e49735cd3ebad3c7a927c0e15d4f993d52076384b9b84f1de6506c44dac0d
• Download the Electron + Go authorization artifact — SHA-256 7d443dd6aa87a31f1b6fa4f1a7c90dbbd188beaad64142c4438752c9e1957754

These are deterministic localhost regression results. They measure the checked-in labs and do not imply perfect detection on arbitrary production targets.

Ground-Truth Coverage

The standalone desktop security lab contains 26 paired HTTP and WebSocket cases. Each vulnerable behavior has a hardened control so the scanner is tested for both sensitivity and specificity.

Control area	Vulnerable behavior	Hardened behavior
Object authorization	Cross-tenant object returned	Cross-tenant request rejected
SSRF	Unsafe internal target accepted	Link-local and unsafe schemes blocked
Redirects	External destination accepted	Local relative destinations only
CORS	Arbitrary origin reflected with credentials	Explicit trusted-origin policy
Sensitive configuration	Synthetic credentials exposed	Non-secret configuration returned
CSRF	State-changing replay accepted	Token required
HTTP race	Duplicate redemption accepted	Idempotency enforced
WebSocket subscription	Foreign tenant accepted	Tenant ownership enforced
WebSocket race	Duplicate action accepted	Idempotency enforced
WebSocket origin	Untrusted origin accepted	Origin allowlist enforced

The separate Electron + Go authorization benchmark adds 34 secure and deliberately vulnerable scenarios across HTTP, GraphQL, and WebSocket controls.

Benchmark Groups

The Python benchmark runner separates three concerns:

1. web_attack_benchmark exercises the HTTP and web-analysis tools against known behavior.
2. websocket_attack_benchmark covers raw replay, application errors, authorization differences, subscription mutation, race waves, and Origin testing.
3. industry_security_controls_benchmark evaluates the same techniques against paired vulnerable and hardened SaaS-style controls.

Reproduce the Run

From the WSHawk source checkout:

python -m benchmarks.run --iterations 3 --warmup 1

Run only the paired security controls and choose an output file:

python -m benchmarks.run industry_security_controls_benchmark \
  --iterations 5 \
  --warmup 1 \
  --output build/benchmarks/industry.json

For the Electron + Go authorization lab:

cd electron-desktop
npm run test:authorization-benchmark

Measurement and Release Gates

• Warm-up runs are excluded.
• Every measured iteration starts a fresh local target and resets mutable state.
• Reports include wall-clock and scenario timing statistics.
• Correctness checks must pass on every iteration.
• Thresholds include margin for shared CI runners.
• Reports are machine-readable and recursively redact secrets.

The suite establishes reproducible behavior for the checked-in labs. It does not establish a universal WAF-bypass rate, a universal false-positive rate, or performance on arbitrary production applications. Heuristic results remain evidence candidates until an operator confirms them.

Standards Context

The benchmark manifest maps controls to OWASP ASVS 5.0.0, OWASP WSTG 4.2, and OWASP API Security Top 10 2023. The mapping explains coverage; it does not claim complete compliance with those standards.