Pith. sign in

REVIEW 3 major objections 6 minor 38 references

Automated Penetration Testing: Formalization and Realization

T0 review · 3 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that its self-organizing ADAPT tool can automate the whole penetration-testing process—planning, runtime decisions, and attack execution—and reports capturing all 11 flags and root on every host in a realistic VM network.

desk verdict A real architecture and implementation, but the full-automation claim is undercut by the hand-curated repertoires; worth reviewing with revisions. read the letter →

arxiv 2412.12745 v1 pith:CRUSJDCK submitted 2024-12-17 cs.CR cs.SE

Charilaos Skandylas , Mikael Asplund This is my paper · ORCID
classification cs.CRcs.SE
keywords AutomatedPenetrationTestingAttackPlanningAutomationFormalModelAutonomicComputingMAPE-KUtility-BasedDecisionMakingSecurity-InformedArchitecture
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Penetration testing today is done largely by scarce human experts, and while many tools automate attack planning or individual exploits, the paper argues that no existing approach covers the whole process against realistic systems. This paper tries to change that by formalizing penetration testing at an architectural level—modeling the target as a security-informed architecture of components and interfaces, and the test as a labeled transition system with an explicit strategy—so the problem can be studied independently of any particular planner or learning method. It then instantiates that formalism in ADAPT, an autonomic tool built on a MAPE-K loop, and claims that ADAPT can run a complete penetration test without human interaction when given a sufficient repertoire of scans and attacks. The reported results are concrete: against Metasploitable2, Metasploitable3, and a realistic virtual network used for ethical-hacking training, ADAPT reached the intended compromise goals, including all 11 flags and root on every host in the VM network. If true, this establishes that end-to-end automation of penetration testing is achievable with current tooling, shifting the practical bottleneck from runtime expertise to the construction of the attack repertoire.

What carries the argument

The load-bearing mechanism is the pairing of a formal model with a control loop. Formally, the target is a security-informed architecture and the penetration test is a labeled transition system plus a strategy; the state records which capabilities the tester holds and which components and interfaces are known, the transition relation is populated by attacks and scans, and the strategy's next-move function $S_N$ selects what to try next. Operationally, the MAPE-K loop (Monitor, Analyze, Plan, Execute, sharing a Knowledge Base) carries the argument: monitoring feeds scan and exploit results into the knowledge base, analysis computes utility rankings over targets, attacks, and scans using $U(o)=\sum_{f\in F} w_f u_f(o)$, planning allocates the next moves under concurrency thresholds, and execution launches the selected tools and installs post-exploitation probes on compromised hosts. The strategy's memory-update function $S_U$ is realized as a re-ranking of targets, attacks, and scans after every adaptation step. The result is an architecture that can keep choosing targets and attacks until the formal goal predicates are satisfied.

What would settle it

A concrete check is to watch a full ADAPT run against the VM network and record every decision point: if any target choice, exploit selection, parameter value, or pivot is supplied or corrected by a human after the run starts, the 'all parts automated' claim fails. The paper reports no such interventions, and the run logs would settle it; a stronger test would strip from the repertoire every exploit tied to the lab's known CVEs and observe whether any path to the 11 flags remains.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that a complete penetration test can be modeled and then run autonomously. Given an unknown target modeled as a security-informed architecture—components with interfaces, capabilities, vulnerabilities, interactions, and security properties—the paper defines a penetration test state as $P = \langle K, C, I\rangle$ (tester capabilities, known components, known interfaces), attacks as sequences of attack steps that add capabilities, scans as actions that add known components and interfaces, and a penetration test as a labeled transition system $T = \langle \mathcal{S}, \mathcal{A}, \Sigma, \rightarrow, P_0, \mathcal{S}_F\rangle$ together with a strategy $S = \langle S_M, S_{M0}, S_U, S_N\rangle$ that updates memory and picks the next action. The paper argues this formalization is general enough to cover AI-planning, POMDP, and reinforcement-learning formulations, and that a MAPE-K autonomic loop provides a concrete way to realize it. ADAPT is that realization for host-and-service networks: it uses utility-based scoring of targets, attacks, and scans to decide what to do next, operates scanners, exploitation frameworks, and post-exploitation tools, and adapts at runtime when scans complete, attacks fail, or new hosts and interfaces surface. The evaluative claim is that ADAPT is, to the authors' knowledge, the first tool able to automate all parts of the penetration-testing process—planning, runtime decision making, and attack automation—against realistic environments, demonstrated by capturing all 11 flags and obtaining root on all hosts in the VM-network case study.

Load-bearing premise

The whole demonstration rests on the authors supplying, in advance, libraries of attacks and scans that already include the exact exploits and parameters needed to defeat each target; a target requiring any technique outside those libraries would not be compromised, because ADAPT selects and applies known attacks rather than inventing new ones.

Editorial extensions

If this is right

  • If the central claim is right, a penetration test can be run end-to-end without a human in the loop, provided a library of attack tactics and scans covering the target's weaknesses exists.
  • The architectural formalization gives a common language for comparing AI-planning, POMDP, and reinforcement-learning pentest methods, since each can be mapped to the same labeled-transition-system-plus-strategy formulation.
  • Runtime decision making based on utility rather than a fixed attack graph lets the tool adapt to failed attacks, newly discovered services, and lateral-movement opportunities during a single run.
  • Automating the operation of standard tools such as nmap, Metasploit, sqlmap, password crackers, and post-exploitation scripts means human effort shifts from executing commands to curating the repertoire and interpreting the final report.
  • Concurrency thresholds for targets and attacks give the operator a direct trade-off between speed and thoroughness, with the reported VM-network runs showing diminishing returns beyond two concurrent paths.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the evaluation suggests the hard part of autonomy is not the control loop but the repertoire; if so, the next measurable step is automated repertoire generation, which the authors themselves list as future work.
  • Editorial inference: because the formal definitions are stated over components and interfaces rather than hosts and IP addresses, the same architecture could be instantiated for API surfaces, containerized services, or component-based software, not just networks of machines.
  • Editorial inference: a direct test of the generality claim would be to run ADAPT against a freshly built target network whose vulnerabilities are covered only by a newly composed repertoire, or to compare its time-to-compromise against human students working the same lab, using flag-capture times as the metric.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper formalizes penetration testing at the architectural level using a security-informed architecture and a labeled transition system, and it proposes a generic autonomic-computing architecture (MAPE-K) with utility-based decision making for automated penetration testing. The authors implement this architecture in the ADAPT tool and report successful, unattended penetration tests against Metasploitable2, Metasploitable3, and a university lab network with 11 flags. The central claim is that ADAPT automates all parts of the penetration testing process, including planning, runtime decision making, and attack automation, against realistic environments.

Significance. If the evaluation were fully convincing, the paper would be a useful step toward end-to-end automated penetration testing: the architectural formalization is reasonably general and appears internally consistent, the MAPE-K instantiation is sensible, and the implementation is released as open source. The exploitation graphs and runtime statistics are valuable qualitative evidence that the architecture can coordinate a real scanner/exploitation stack. However, the principal empirical claim is weakened by a circularity in the evaluation design: the attack and scan repertoires were deliberately populated with the exact capabilities needed to compromise the targets, so the reported success demonstrates orchestration of a hand-selected exploit set rather than autonomous discovery or planning against unknown systems. This does not invalidate the formal or architectural contributions, but it materially narrows what the evaluation establishes.

major comments (3)
  1. [Section 6.2, Section 7] The central claim in Section 7 that ADAPT is 'the fist tool that is able to automate all parts of the penetration testing process including planning, dynamic at runtime decision making and attack automation that can be employed against realistic environments' is not supported by the evaluation as designed. Section 6.2 explicitly states: 'we opted to use repertoires that contain the required capabilities to successfully complete the individual exploits against the hosts of the VM network.' Because the repertoires were constructed using prior knowledge of the target systems, the successful runs in Section 6.3 show that ADAPT can select and execute a prespecified set of known exploits, not that it can operate against previously unknown systems. To support the full-automation claim, the paper needs an out-of-sample evaluation in which the repertoires are not tailored to the targets, or at least an ablation that separates the contribution of repertoire coverage from the contribution of the decision-making engine.
  2. [Section 2, Section 6.2] The related-work section claims that the approach 'requires no knowledge of the system architecture, vulnerabilities or functionality.' This is accurate only if 'the approach' refers strictly to the runtime operation of ADAPT after the repertoires and utility parameters have been created. Section 6.2 shows that the designers needed substantial target-specific knowledge to build the attack and scan repertoires: the repertoires had to contain the specific techniques, parameters, and ordering that would compromise the hosts. The paper should clarify this boundary and rephrase the claim so it does not imply that the overall method, including its configuration, requires no knowledge of the target. As written, the claim in Section 2 is in direct tension with the evaluation setup in Section 6.2.
  3. [Section 6.3] For the VM-network case study, the paper reports a single run of the tool (the exploitation graph in Figure 6 is described as 'a single run'). No repeated runs at the same concurrency threshold are reported, so the success rate and variance across runs are unknown. Since the same repertoires are used and the utility scores converge in Figure 8, the authors should state how many runs were performed and, if only one, acknowledge that the demonstration is a single data point.
minor comments (6)
  1. [Section 7] There is a typo in the conclusion: 'the fist tool' should be 'the first tool.'
  2. [Definition 5 (Section 4.2)] In the definition of a strategy, the notation S_N : S_M × I → T uses I, but I was previously defined as a set of interfaces in Definition 2; the intended domain is the set of penetration test states, which is denoted M in Definition 5. Please correct this notation for clarity.
  3. [Definition 4 (Section 4.1)] The text after Definition 4 reads 'After a a scan's completion'; the duplicated article is a typo.
  4. [Section 6.1] The name 'Metaspoitable3' appears once in the setup text; it should be 'Metasploitable3' for consistency with the rest of the paper.
  5. [Figure 6] In the VM-network exploitation graph, one node is labeled 'H4∶1'; this appears to be a typo for 'H4∶I1'.
  6. [Section 2] The statement that the concrete implementation 'outperforms them in the number of services exploited, running time and scalability' with respect to LLM-based tools is not substantiated by any experimental data or quantitative comparison in the evaluation section. Since no comparative experiments are reported, this claim should be removed or supported with a dedicated comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: ADAPT's automation claim is explicitly conditional on a supplied attack/scan repertoire, and the formal model and MAPE-K architecture are self-contained.

full rationale

The paper's formalization (Definitions 1-5) and the MAPE-K/utility-based architecture are derived independently of the evaluation results; there are no load-bearing self-citations (the reference list contains no Skandylas/Asplund entries) and no imported uniqueness theorems. The central automation claim in Section 7 is explicitly scoped: it covers planning, runtime decision-making, and attack automation, not the discovery of new attack techniques or automatic repertoire generation. Section 5.1 states that the architecture 'automate[s] the selection and application of previously known, generic and widely applicable attacks rather than invent new attack techniques,' and Section 6.2 explicitly says the repertoires were chosen to contain the required capabilities and that success is measured by navigation, runtime decisions, and context-dependent tool parametrization, not by repertoire completeness. The VM-network evaluation is therefore an in-sample demonstration of the orchestration layer under a disclosed, target-aware input condition, which limits external generalizability but does not make the claimed derivation equivalent to its input. For this reason, the tailored repertoire is a validity boundary stated by the authors, not a hidden circular step.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central claim rests on the assumption that target systems are representable as security-informed architectures and on hand-selected utility weights and hand-crafted attack and scan repertoires. No new physical or conceptual entities are introduced beyond standard architecture and autonomic computing concepts.

free parameters (5)
  • Target utility weights (W_C) = S 0.2, V 0.2, C 0.2, E 0.4
    Hand-set in Table 4; determine which hosts are prioritized as targets.
  • Attack utility weights (W_A) = V 0.3, C 0.2, P 0.2, U 0.1, T 0.2
    Hand-set in Table 5; determine which attack tactics are ranked higher.
  • Scan utility weights (W_S) = R 0.25, T 0.25, D 0.25, C 0.25
    Hand-set in Table 6; determine scan selection.
  • Utility value constants = 0.73, 0.9, 1.0, 0.23, 0.57, 0.32, 0.31, 0.12
    Hand-chosen in Tables 7-9 to map CVSS-like levels to normalized values in the utility function.
  • Concurrency thresholds CC and CA = 1, 2, 3
    Set for experiments in Section 6.3; not derived from any theory or data.
assumptions (5)
  • domain assumption The target system can be modeled as a security-informed architecture with components and interfaces (Definition 1).
    Section 4: 'We assume that the system to be penetration tested is modeled as a security-informed architecture that is initially unknown to the penetration tester.'
  • domain assumption Interface sets and capability sets of components are pairwise disjoint.
    Section 3.1: 'We assume that the sets of interfaces of each component are disjoint... Similarly, the set of each interface's capabilities are assumed to be disjoint.'
  • domain assumption The penetration testing goal is to discover all components and interfaces and gain all capabilities (Equations 2-4).
    Section 4.2 defines terminal states via these equations; alternative goals are mentioned but not explored.
  • standard math Standard labeled transition system and game strategy semantics.
    Definition 5 uses labeled transition systems from [13] and strategies from [20].
  • standard math Utility-based decision theory with normalized values and weights that sum to 1.
    Section 3.3, Equation 1 follows von Neumann and Morgenstern utility theory.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Automated Penetration Testing: Formalization and Realization." pith.science (2026). https://pith.science/paper/CRUSJDCK

@misc{pith2026241212745,
  author       = {Pith},
  title        = {Pith review of: Automated Penetration Testing: Formalization and Realization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/CRUSJDCK}},
  note         = {Machine review of arXiv:2412.12745}
}
read the original abstract

Recent changes in standards and regulations, driven by the increasing importance of software systems in meeting societal needs, mandate increased security testing of software systems. Penetration testing has been shown to be a reliable method to asses software system security. However, manual penetration testing is labor-intensive and requires highly skilled practitioners. Given the shortage of cybersecurity experts and current societal needs, increasing the degree of automation involved in penetration testing can aid in fulfilling the demands for increased security testing. In this work, we formally express the penetration testing problem at the architectural level and suggest a general self-organizing architecture that can be instantiated to automate penetration testing of real systems. We further describe and implement a specialization of the architecture in the ADAPT tool, targeting systems composed of hosts and services. We evaluate and demonstrate the feasibility of ADAPT by automatically performing penetration tests with success against: Metasploitable2, Metasploitable3, and a realistic virtual network used as a lab environment for penetration tester training.

Figures

Figures reproduced from arXiv: 2412.12745 by the authors.

Figure 1
Figure 1. shows an example security-informed archi￾tecture. It comprises 5 components: WebServer, APIGate, Authentication, Business Logic and Database. Of those, the Webserver and APIGate components are exposed to the internet, and all components are connected in a private virtual LAN network. The system models a small-scale web architecture. The web server acts as the presentation layer, while the APIGate combined with the A… view at source ↗
Figure 2
Figure 2. Automated Penetration Testing Architecture we discuss each adaptation phase and its mapping to the elements of the previous section. The following subsection describes the specific decisions made in our concrete im￾plementation of ADAPT that utilizes utility theory for its decision making. The general architecture is shown in [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Groups that have captured each flag per week ADAPT implements the architecture presented in Sec￾tion. 5.1, hence it uses the functions described in Next Move(s) ADAPT for target and attack selection. ADAPT is equipped with a scan repertoire that is able to perform 8 scans and an attack repertoire with 41 attack tactics and 57 attack techniques. The scanning and exploitation capabilities provided by the repertoires d… view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: The exploitation graph for Metasploitable3 notation for interfaces: "𝐻𝑛 ∶ 𝐼𝑚", where 𝐻 and 𝐼 signify host and interface respectively and 𝑛 and 𝑚 are natural numbers. We show the flags found as capabilities, identified by an initial ’F’ character. Since the flags in the…
Figure 4
Figure 4. Figure 4: ) on Metasploitable2 typically requires exploiting a single vulnerability and can be achieved through 11 different interfaces, 𝐼5 to 𝐼15. Moreover, a regular user, msfadmin (shown as 𝐶4 ), has passwordless sudo privileges, leading to a two step compromise. The tool has…
Figure 7
Figure 7. Figure 7: Running time per ADAPT component nature of ADAPT’s implementation, which allows adapta￾tions to be triggered as soon as any scan, exploitation step or post-exploitation tool run has completed. 0 1 2 3 4 5 6 7 8 9 10 11 0.5 1 1.5 2 2.5 Adaptation Step Cumulative Utility…
Figure 6
Figure 6. Figure 6: Lab environment exploitation graph [PITH_FULL_IMAGE:figures/full_fig_p014_6.png]
Figure 8
Figure 8. Figure 8: shows the cumulative utility score after each adaptation step for different target and attack thresholds in the VM network case study. As expected, since the same repertoires are being used in all three runs against the VM network, utility converges to the same final s…
Figure 9
Figure 9. Figure 9: VM network time per adaptation step. 7. Conclusion We have formulated penetration testing at the architec￾tural level and proposed a general self-adaptive architecture to automate penetration testing. We have further described the design and implementation of ADAPT, a …

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

38 extracted references · 28 canonical work pages

  1. [1]

    Foundations of Rational Choice Under Risk, Clarendon Press (1995),https:// books.google.se/books?id=UCzHwAEACAAJ

    Anand, P.: Foundations of Rational Choice Under Risk. Foundations of Rational Choice Under Risk, Clarendon Press (1995),https:// books.google.se/books?id=UCzHwAEACAAJ

    work page 1995

  2. [2]

    it - Information Technology59(2), 93–100 (2017)

    Bratus, S., Shubina, A.: Exploitation as code reuse: On the need of formalization. it - Information Technology59(2), 93–100 (2017). https://doi.org/doi:10.1515/itit-2016-0038, https://doi.org/10.1515/ itit-2016-0038

    work page doi:10.1515/itit-2016-0038 2017

  3. [3]

    Computers & Security126, 103055 (2023)

    Chen, J., Hu, S., Zheng, H., Xing, C., Zhang, G.: Gail-pt: An intelligent penetration testing framework with generative adversar- ial imitation learning. Computers & Security126, 103055 (2023). https://doi.org/https://doi.org/10.1016/j.cose.2022.103055, https:// www.sciencedirect.com/science/article/pii/S0167404822004473

    arXiv 2023

  4. [4]

    26,323–369 (2006), https://api.semanticscholar.org/CorpusID:12806220

    Chen, Y., Wah, B.W., Hsu, C.W.: Temporal planning using subgoal partitioningandresolutioninsgplan.J.Artif.Intell.Res. 26,323–369 (2006), https://api.semanticscholar.org/CorpusID:12806220

    work page 2006

  5. [5]

    5525, pp

    Cheng, B.H.C., de Lemos, R., Giese, H., Inverardi, P., Magee, J., Andersson, J., Becker, B., Bencomo, N., Brun, Y., Cukic, B., Seru- gendo, G.D.M., Dustdar, S., Finkelstein, A., Gacek, C., Geihs, K., Grassi, V., Karsai, G., Kienle, H.M., Kramer, J., Litoiu, M., Malek, S.,Mirandola,R.,Müller,H.A.,Park,S.,Shaw,M.,Tichy,M.,Tivoli, M., Weyns, D., Whittle, J.:...

    2009

  6. [6]

    In: 2020 16th International Conference on Mobility, Sensing and Networking (MSN)

    Chowdhary, A., Huang, D., Mahendran, J.S., Romo, D., Deng, Y., Sabur, A.: Autonomous security analysis and penetration testing. In: 2020 16th International Conference on Mobility, Sensing and Networking (MSN). pp. 508–515 (2020). https://doi.org/10.1109/MSN50589.2020.00086

    work page arXiv 2020

  7. [7]

    In: 2023 3rd International Conference on Electronic and ElectricalEngineeringandIntelligentSystem(ICE3IS).pp.322–326 (2023)

    Clintswood, Lie, D.G., Kuswandana, L., Nadia, Achmad, S., Suhartono, D.: The usage of machine learning on penetration testing automation. In: 2023 3rd International Conference on Electronic and ElectricalEngineeringandIntelligentSystem(ICE3IS).pp.322–326 (2023). https://doi.org/10.1109/ICE3IS59323.2023.10335188

    work page arXiv 2023

  8. [8]

    https://doi.org/https://doi.org/10.6028/NIST.IR.7511r5

    Cook, M., Prisaca, D., Quinn, S., Waltermire, D.: Security content automation protocol (scap) version 1.3 validation program test requirements (2018-04-20 2018). https://doi.org/https://doi.org/10.6028/NIST.IR.7511r5

    work page doi:10.6028/nist.ir.7511r5 2018

Show all 38 references
  1. [9]

    In: 33rd USENIX Security Symposium (USENIX Security 24)

    Deng, G., Liu, Y., Mayoral-Vilches, V., Liu, P., Li, Y., Xu, Y., Zhang,T.,Liu,Y.,Pinzger,M.,Rass,S.:PentestGPT:Evaluatingand harnessing large language models for automated penetration testing. In: 33rd USENIX Security Symposium (USENIX Security 24). pp. 847–864.USENIXAssociati...

  2. [10]

    IEEE Transactions on Emerging Topics in Computing 8(2), 391–403 (2020)

    Dullien, T.: Weird machines, exploitability, and provable unex- ploitability. IEEE Transactions on Emerging Topics in Computing 8(2), 391–403 (2020). https://doi.org/10.1109/TETC.2017.2785299

    2020

  3. [11]

    In: Garcia-Alfaro, J., Kozik, R., Choraś, M., Katsikas, S

    Faillon, M.A., Bout, B., Francq, J., Neal, C., Boulahia-Cuppens, N., Cuppens, F., Yaich, R.: How to better fit reinforcement learning for pentesting: A new hierarchical approach. In: Garcia-Alfaro, J., Kozik, R., Choraś, M., Katsikas, S. (eds.) Computer Security – ESORICS 2024...

    2024

  4. [12]

    ArXivabs/1106.4561 (2003), https:// api.semanticscholar.org/CorpusID:1397894

    Fox, M., Long, D.: Pddl2.1: An extension to pddl for expressing temporal planning domains. ArXivabs/1106.4561 (2003), https:// api.semanticscholar.org/CorpusID:1397894

    2003 arXiv

  5. [13]

    the research reported in this paper has been initiated at cwi in amsterdam, continued at the technical university of munich, and finalized at stanford university

    van Glabbeek, R.: Chapter 1 - the linear time - branching time spectrum i.**this is an extension of [20]. the research reported in this paper has been initiated at cwi in amsterdam, continued at the technical university of munich, and finalized at stanford university. it has b...

    2001

  6. [14]

    https://doi.org/10.1007/s10207-024-00835-x, https:// doi.org/10.1007/s10207-024-00835-x

    Hilario, E., Azam, S., Sundaram, J., Imran Mohammed, K., Shan- mugam, B.: Generative ai for pentesting: the good, the bad, the ugly.InternationalJournalofInformationSecurity 23(3),2075–2097 (Jun 2024). https://doi.org/10.1007/s10207-024-00835-x, https:// doi.org/10.1007/s10207...

    2024 doi

  7. [15]

    In: Proceed- ings of the 15th European Conference on Artificial Intelligence

    Hoffmann, J.: Extending ff to numerical state variables. In: Proceed- ings of the 15th European Conference on Artificial Intelligence. p. 571–575. ECAI’02, IOS Press, NLD (2002)

    2002

  8. [16]

    In: 2014 IEEE 15th International Symposium on Computa- tional Intelligence and Informatics (CINTI)

    Holik, F., Horalek, J., Marik, O., Neradova, S., Zitta, S.: Effec- tive penetration testing with metasploit framework and methodolo- gies. In: 2014 IEEE 15th International Symposium on Computa- tional Intelligence and Informatics (CINTI). pp. 237–242 (2014). https://doi.org/10...

    2014

  9. [17]

    In: 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW)

    Hu, Z., Beuran, R., Tan, Y.: Automated penetration testing using deep reinforcement learning. In: 2020 IEEE European Symposium on Security and Privacy Workshops (EuroS&PW). pp. 2–10 (2020). https://doi.org/10.1109/EuroSPW51379.2020.00010

    2020

  10. [18]

    In: 2022 4th International Conference on Smart Sensors and Application (ICSSA)

    Jagamogan, R.S., Ismail, S.A., Hassan, N.H., Abas, H.: Penetration testing procedure using machine learning. In: 2022 4th International Conference on Smart Sensors and Application (ICSSA). pp. 58–63 (2022). https://doi.org/10.1109/ICSSA54161.2022.9870951

    2022

  11. [19]

    Computer 36(1), 41–50 (Jan 2003)

    Kephart, J.O., Chess, D.M.: The vision of autonomic computing. Computer 36(1), 41–50 (Jan 2003). https://doi.org/10.1109/MC.2003.1160055, http://dx.doi.org/ 10.1109/MC.2003.1160055

    2003 arXiv

  12. [20]

    In: Chatzigiannakis, I., Mitzenmacher, M., Rabani, Y., Sangiorgi, D

    Kwiatkowska, M.Z.: Model Checking and Strategy Synthesis for Stochastic Games: From Theory to Practice. In: Chatzigiannakis, I., Mitzenmacher, M., Rabani, Y., Sangiorgi, D. (eds.) 43rd International Colloquium on Automata, Languages, and Programming (ICALP 2016). Leibniz Inter...

    2016 doi

  13. [21]

    Lee, N.: DARPA’s Cyber Grand Challenge (2014–2016), pp. 429–

    2014

  14. [22]

    Computers & Security 132, 103358 (2023)

    Li, Q., Zhang, M., Shen, Y., Wang, R., Hu, M., Li, Y., Hao, H.: A hierarchical deep reinforcement learning model with expert prior knowledge for intelligent penetration testing. Computers & Security 132, 103358 (2023). https://doi.org/https://doi.org/10.1016/j.cose.2023.103358...

    2023

  15. [23]

    Obes, J.L., Sarraute, C., Richarte, G.: Attack planning in the real world.CoRR abs/1306.4044(2013), http://arxiv.org/abs/1306.4044

    2013 arXiv

  16. [24]

    In: Proceedings of the 13th ACM Conference on Computer and Communications Security

    Ou, X., Boyer, W.F., McQueen, M.A.: A scalable approach to attack graph generation. In: Proceedings of the 13th ACM Conference on Computer and Communications Security. pp. 336–345. CCS ’06, ACM, New York, NY, USA (2006). https://doi.org/10.1145/1180405.1180446, http://doi.acm....

    2006

  17. [25]

    John Wiley & Sons (2014)

    Puterman, M.L.: Markov decision processes: discrete stochastic dy- namic programming. John Wiley & Sons (2014)

    2014

  18. [26]

    org/CorpusID:14462292

    Sarraute, C., Buffet, O., Hoffmann, J.: Penetration testing == pomdp solving?ArXiv abs/1306.4714(2013), https://api.semanticscholar. org/CorpusID:14462292

    2013 arXiv

  19. [27]

    In: Proceedings of the 4th ACM workshop on Security and artificial intelligence

    Sarraute, C., Richarte, G., Lucángeli Obes, J.: An algorithm to find optimal attack paths in nondeterministic scenarios. In: Proceedings of the 4th ACM workshop on Security and artificial intelligence. CCS’11, ACM (Oct 2011). https://doi.org/10.1145/2046684.2046695, http://dx....

    2011

  20. [28]

    org/CorpusID:237259783

    Standen, M., Lucas, M., Bowman, D., Richer, T.J., Kim, J., Marriott, D.A.: Cyborg: A gym for the development of autonomous cyber agents.ArXiv abs/2108.09118(2021), https://api.semanticscholar. org/CorpusID:237259783

    2021 arXiv

  21. [29]

    von Neumann, J., Morgenstern, O.: Theory of Games and Economic Behavior.PrincetonUniversityPress,NewJersey,secondedn.(1947)

    1947

  22. [30]

    Weyns,D.:SoftwareEngineeringofSelf-adaptiveSystems,pp.399–

  23. [31]

    NATO SUPREME ALLIED COMMAND TRANSFORMA- TION NORFOLK VA NORFOLK (10 2015)

    Williams, A.: Autonomous Systems: Issues for Defence Policymak- ers. NATO SUPREME ALLIED COMMAND TRANSFORMA- TION NORFOLK VA NORFOLK (10 2015)

    2015

  24. [32]

    Applied Sci- ences 11(19) (2021)

    Zhou, S., Liu, J., Hou, D., Zhong, X., Zhang, Y.: Autonomous penetration testing based on improved deep q-network. Applied Sci- ences 11(19) (2021). https://doi.org/10.3390/app11198823,https:// www.mdpi.com/2076-3417/11/19/8823

    2021 doi

  25. [33]

    Frontiers of Information Technol- ogy & Electronic Engineering20(9), 1277–1288 (Sep 2019),https: //doi.org/10.1631/FITEE.1800532 C

    Zhou, T.y., Zang, Y.c., Zhu, J.h., Wang, Q.x.: Nig-ap: a new method for automated penetration testing. Frontiers of Information Technol- ogy & Electronic Engineering20(9), 1277–1288 (Sep 2019),https: //doi.org/10.1631/FITEE.1800532 C. Skandylas, M. Asplund:Preprint submitted t...

    2019 doi

  26. [36]

    For each service,𝜐 we create an interface𝑖𝜐∈𝐼𝜙 and the corresponding open port𝜃 is a property:𝜋𝜃 ∈Π 𝜐

    Every𝜙 ∈ Φis mapped to a component𝑐𝜙 ∈ 𝐶,𝜄, 𝑜and𝜀areeachmappedtocorrespondingcomponent properties of𝑐𝜙,𝜋𝜄∈Π 𝜙,𝜋𝑜∈Π 𝜙 and𝜋𝜀∈Π 𝜙. For each service,𝜐 we create an interface𝑖𝜐∈𝐼𝜙 and the corresponding open port𝜃 is a property:𝜋𝜃 ∈Π 𝜐

  27. [37]

    Every action𝜓 ∈Ψ is mapped to either a scan𝜎∈Σ ortoanattackstep 𝛼.Eachattackstepalsoconstitutes an attack𝐴 ∈ , since the authors in [33] make no distinctionbetweenattackstepsandcompleteattacks

  28. [38]

    Actionprobabilities Ψ andrewards, Ψ canbemod- eledthroughastrategy 𝑆= ⟨𝑀 ,𝑀  0 ,𝑀  + ,𝑁  + ⟩ where𝑀  stores Ψ and Ψ,𝑀  + isusedtoupdate their values and𝑁  + returns the action𝜓 with the highest reward in the current state𝜙. Implementation and Case Study Details Tab...

    2008

  29. [443]

    Springer International Publishing, Cham (2019)

    2019

  30. [456]

    Springer International Publishing, Cham (2015)

    2015

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.