Penetration Testing

Penetration testing, the simulated ethical hacking of systems to identify vulnerabilities, is increasingly being automated using artificial intelligence. Current research focuses on developing and benchmarking AI agents, often employing reinforcement learning algorithms like A3C and DQN, or leveraging large language models (LLMs) such as GPT-4, to enhance efficiency and effectiveness across various penetration testing phases, from reconnaissance to post-exploitation. These advancements aim to improve the speed and comprehensiveness of security assessments, ultimately strengthening cybersecurity defenses and reducing reliance on scarce human expertise.

Papers

October 10, 2023

LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing
Stephen Moskal, Sam Laney, Erik Hemberg, Una-May O'Reilly
Large Language Model Agent Smith Penetration Testing Threat Landscape Cyber Security Malicious Code

September 27, 2023

Raij\=u: Reinforcement Learning-Guided Post-Exploitation for Automating Security Assessment of Network Systems
Van-Hau Pham, Hien Do Hoang, Phan Thanh Trung, Van Dinh Quoc, Trong-Nghia To, Phan The Duy
Reinforcement Learning Positive Reinforcement Real World eXploitation Computer Network Penetration Testing

July 24, 2023

Getting pwn'd by AI: Penetration Testing with Large Language Models
Andreas Happe, Jürgen Cito
Artificial Intelligence Software Vulnerability Prediction Penetration Testing Password Strength Security Testing

May 26, 2023

NASimEmu: Network Attack Simulator & Emulator for Training Agents Generalizing to Novel Scenarios
Jaromír Janisch, Tomáš Pevný, Viliam Lisý
Multi Scenario Simulation Framework Training Agent Penetration Testing Basic Emulator

March 20, 2023

Maximizing Penetration Testing Success with Effective Reconnaissance Techniques using ChatGPT
Sheetal Temara
ChatGPT Generated Conversation Penetration Testing Artificial Intelligence Language Model

December 28, 2022

HeATed Alert Triage (HeAT): Transferrable Learning to Extract Multistage Attack Campaigns
Stephen Moskal, Shanchieh Jay Yang
Cyber Attack Penetration Testing Novel Attack Attack Pattern Model Transfer Alert Triage

June 22, 2022

Vulnerability Prioritization: An Offensive Security Approach
Muhammed Fatih Bulut, Abdulhamid Adebayo, Daby Sow, Steve Ocepek
Security Vulnerability Common Vulnerability Penetration Testing Offensive Security

April 5, 2022

GAIL-PT: A Generic Intelligent Penetration Testing Framework with Generative Adversarial Imitation Learning
Jinyin Chen, Shulong Hu, Haibin Zheng, Changyou Xing, Guomin Zhang
Action Space Penetration Testing Generative Adversarial Imitation Learning

February 22, 2022

Behaviour-Diverse Automatic Penetration Testing: A Curiosity-Driven Multi-Objective Deep Reinforcement Learning Approach
Yizhou Yang, Xin Liu
Multi Objective Reinforcement Learning Penetration Testing Multi Objective Deep Reinforcement Learning

Penetration Testing

Papers

LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing

Raij\=u: Reinforcement Learning-Guided Post-Exploitation for Automating Security Assessment of Network Systems

Getting pwn'd by AI: Penetration Testing with Large Language Models

NASimEmu: Network Attack Simulator & Emulator for Training Agents Generalizing to Novel Scenarios

Maximizing Penetration Testing Success with Effective Reconnaissance Techniques using ChatGPT

HeATed Alert Triage (HeAT): Transferrable Learning to Extract Multistage Attack Campaigns

Vulnerability Prioritization: An Offensive Security Approach

GAIL-PT: A Generic Intelligent Penetration Testing Framework with Generative Adversarial Imitation Learning

Behaviour-Diverse Automatic Penetration Testing: A Curiosity-Driven Multi-Objective Deep Reinforcement Learning Approach