Abstract:Penetration Testing is a methodology for assessing network security, by generating and executing possible attacks. Doing so automatically allows for regular and systematic testing. A key question then is how to automatically generate the attacks. A natural way to address this issue is as an attack planning problem. In this thesis, we are concerned with the specific context of regular automated pentesting, and use the term "attack planning" in that sense. The following three research directions are investigated. First, we introduce a conceptual model of computer network attacks, based on an analysis of the penetration testing practices. We study how this attack model can be represented in the PDDL language. Then we describe an implementation that integrates a classical planner with a penetration testing tool. This allows us to automatically generate attack paths for real world pentesting scenarios, and to validate these attacks by executing them. Secondly, we present efficient probabilistic planning algorithms, specifically designed for this problem, that achieve industrial-scale runtime performance (able to solve scenarios with several hundred hosts and exploits). These algorithms take into account the probability of success of the actions and their expected cost (for example in terms of execution time, or network traffic generated). Finally, we take a different direction: instead of trying to improve the efficiency of the solutions developed, we focus on improving the model of the attacker. We model the attack planning problem in terms of partially observable Markov decision processes (POMDP). This grounds penetration testing in a well-researched formalism. POMDPs allow the modelling of information gathering as an integral part of the problem, thus providing for the first time a means to intelligently mix scanning actions with actual exploits.

A Multi-Stage Attack Planning Problem Description Model Based on Knowledge Representation

A Multi-Stage Attack Scenario Recognition Algorithm Based on Intelligent Planning

Attack Planning in the Real World

Think That Attackers Think: Using First-Order Theory of Mind in Intrusion Response System.

Multi-agent based hybrid Intrusion detection system

From Sands to Mansions: Simulating Full Attack Chain with LLM-Organized Knowledge

A Network Attack Plan Recognition Algorithm Based on the Extended Goal Graph

Automated Attack Planning

Large-scale Network Intrusion Detection System Based on MultiAgents

Knowledge Graph and Behavior Portrait of Intelligent Attack Against Path Planning

Multi-Step Attack-Oriented Assessment Of Network Security Situation

A graph based system for multi-stage attacks recognition

Strategic Planning for Network Data Analysis

MODELING ATTACK SCENARIO WITH CAPABILITY

Modeling and Detection of the Multi-Stages of Advanced Persistent Threats Attacks Based on Semi-Supervised Learning and Complex Networks Characteristics

Knowledge Organization And Logical Description For Multi-Agent Tactical Plan Recognition

Capability-centric Attack Model for Network Security Analysis

Correlating Multi-Step Attack and Constructing Attack Scenarios Based on Attack Pattern Modeling

An Intrusion Plan Recognition Algorithm Based On Max-1-Connected Causal Networks

Multi-step Attack Scenarios Mining Based on Neural Network and Bayesian Network Attack Graph.

Attack Scenarios Reasoning, Hypothesizing and Predicting Based on Capability Transition Model