Survey on Automated Penetration Testing Technology Research

被引：0
|
作者：
Chen K. [1 ]
Lu H. [1 ]
Fang B.-X. [1 ]
Sun Y.-B. [1 ]
Su S. [1 ]
Tian Z.-H. [1 ]
机构：
[1] Cyberspace Institute of Advanced Technology, Guangzhou University, Guangzhou
来源：
Ruan Jian Xue Bao/Journal of Software | 2024年 / 35卷 / 05期
关键词：
attack graph; automated penetration testing; BDI-Agent; reinforcement learning;
D O I：
10.13328/j.cnki.jos.007038
中图分类号：
学科分类号：
摘要：
Penetration testing is an important means to discover the weaknesses of significant network information systems and protect network security. Traditional penetration testing relies heavily on manual labor and has high technical requirements for testers, limiting the popularization depth and breadth. By introducing artificial intelligence technology into the whole penetration testing process, automated penetration testing lowers the technical threshold of penetration testing based on greatly solving the problem of heavy dependence on manual labor. Automated penetration testing can be mainly divided into model-based and rule-based automated penetration testing, and the research of the two has their respective focuses. The former utilizes model algorithms to simulate hacker attacks with attention paid to attack scene perception and attack decision-making models. The latter concentrates on how to efficiently adapt attack rules and attack scenarios. This study mainly analyzes the implementation principles of automated penetration testing from three aspects of attack scenario modeling, penetration testing modeling, and decision-making reasoning model. Finally, the future development direction of automated penetration is explored from the dimensions of attack-defense confrontation and vulnerability combination utilization. © 2024 Chinese Academy of Sciences. All rights reserved.
引用
收藏
页码：2235 / 2267
页数：32
相关论文
共 158 条
  • [11] Computer security worries military experts, (1983)
  • [12] Stefinko Y, Piskozub A, Banakh R., Manual and automated penetration testing. Benefits and drawbacks. Modern tendency, Proc. of the 13th Int’l Conf. on Modern Problems of Radio Engineering, Telecommunications and Computer Science (TCSET), pp. 488-491, (2016)
  • [13] Nmap: The network mapper, (2023)
  • [14] Download nessus vulnerability assessment, (2023)
  • [15] Herzog P., Open-source security testing methodology manual, (2003)
  • [16] Information Systems Security Assessment Framework, (2006)
  • [17] The penetration testing execution standard documentation, (2022)
  • [18] Strom BE, Applebaum A, Miller DP, Nickels KC, Pennington AG, Thomas CB., MITRE ATT&CK: Design and philosophy, (2018)
  • [19] Boddy M, Gohde J, Haigh T, Harp S., Course of action generation for cyber security using classical planning, Proc. of the 15th Int’l Conf. on Automated Planning and Scheduling, pp. 12-21, (2005)
  • [20] Obes JL, Sarraute C, Richarte G., Attack planning in the real world, (2013)
12345678910