Abstract:Penetration testing (PT) is an efficient tool for network testing and vulnerability mining by simulating the hackers' attacks to obtain valuable information applied in operating and database systems. Most of the traditional manual solutions are strongly relying on the domain knowledge of human experts with high penetration costs. Therefore, solutions based on the artificial intelligent algorithm such as reinforcement learning (RL) and deep reinforcement learning (DRL), with less time-consuming and lower labor costs, become a great solution to address the challenge. However, there are still a few challenges for RL/DRL-based PT in real penetration scenarios, such as the large dimension size of the agent's discrete action space usually causing difficulties in convergence. To address the above issue, this paper proposes a novel framework named G enerative A dversarial I mitation L earning based intelligent P enetration T esting (GAIL-PT), which utilizes expert knowledge base and GAIL network to guide the policy generation of RL/DRL agents with lower costs. Specifically, we first construct the expert knowledge bases by collecting state-action pairs from the successful exploitations of pre-trained RL/DRL models. Secondly, we feed the expert knowledge bases generated by different RL/DRL models online into the discriminator of GAIL-PT to guide its training process. Besides, we integrate the losses of the generator and the discriminator in GAIL-PT to optimize the overall objective and use the discriminator's discounted rewards for policy generation. The extensive experiments conducted on the practical target hosts and simulated network scenarios demonstrate that GAIL-PT achieves outstanding performance, and outperforms the state-of-art method DeepExploit in exploiting Metasploitable2 and Q-learning in different scale networks. It also verified that GAIL-PT is a general leading framework suitable for RL/DRL-based methods. The code of GAIL-PT is open-sourced at https://github.com/Shulong98/GAIL-PT//.

Capture the Flag with ChatGPT: Security Testing with AI ChatBots

Maximizing Penetration Testing Success with Effective Reconnaissance Techniques using ChatGPT

Chatbots in a Botnet World

Chatgpt for cybersecurity: practical applications, challenges, and future directions

Getting pwn'd by AI: Penetration Testing with Large Language Models

A Qualitative Study on Using ChatGPT for Software Security: Perception vs. Practicality

ChatGPT for Digital Forensic Investigation: The Good, The Bad, and The Unknown

Exploring the Limits of ChatGPT in Software Security Applications

Chatbots in a Honeypot World

Chatbots to ChatGPT in a Cybersecurity Space: Evolution, Vulnerabilities, Attacks, Challenges, and Future Recommendations

ChatGPT in forensic sciences: a new Pandora's box with advantages and challenges to pay attention

Evaluating the Impact of ChatGPT on Exercises of a Software Security Course

CIPHER: Cybersecurity Intelligent Penetration-Testing Helper for Ethical Researcher

Using Large Language Models for Cybersecurity Capture-The-Flag Challenges and Certification Questions

ChatGPT's Security Risks and Benefits: Offensive and Defensive Use-Cases, Mitigation Measures, and Future Implications

Creating a Bot-tleneck for malicious AI: Psychological methods for bot detection

GAIL-PT: An Intelligent Penetration Testing Framework with Generative Adversarial Imitation Learning

PentestGPT: An LLM-empowered Automatic Penetration Testing Tool

Unmasking the giant: A comprehensive evaluation of ChatGPT's proficiency in coding algorithms and data structures

Exploring ChatGPT's Capabilities on Vulnerability Management

Beyond the Safeguards: Exploring the Security Risks of ChatGPT