NIG-AP：一种自动化渗透测试新方法

周天阳; 臧艺超; 朱俊虎; 王清贤

doi:10.1631/FITEE.1800532

Your Location：

Home >

Browse articles >

NIG-AP：一种自动化渗透测试新方法

常规文章 | Updated：2022-05-19

- NIG-AP：一种自动化渗透测试新方法
- NIG-AP: a new method for automated penetration testing
- 信息与电子工程前沿（英文） 2019年20卷第9期页码：1277-1288
- Affiliations：
  
  State Key Laboratory of Mathematical Engineering and Advanced Computing, Zhengzhou 450001, China
  China National Digital Switching System Engineering and Technological R & D Center, Zhengzhou 450001, China
- Author bio：
  
  Yi-chao ZANG, E-mail: zangyeechao@sina.com
- Funds：
  
  Project supported by the National Natural Science Foundation of China (No. 61502528)
- DOI：10.1631/FITEE.1800532
  中图分类号： TP393.08
- 收稿：2018-09-03，
  
  修回：2019-;9-;4，
  
  纸质出版：2019-09
- Accepted：
Scan QR Code
周天阳, 臧艺超, 朱俊虎, 等. NIG-AP：一种自动化渗透测试新方法[J]. 信息与电子工程前沿（英文）, 2019,20(9):1277-1288.

Tian-yang ZHOU, Yi-chao ZANG, Jun-hu ZHU, et al. NIG-AP: a new method for automated penetration testing[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(9): 1277-1288.
周天阳, 臧艺超, 朱俊虎, 等. NIG-AP：一种自动化渗透测试新方法[J]. 信息与电子工程前沿（英文）, 2019,20(9):1277-1288. DOI： 10.1631/FITEE.1800532.

Tian-yang ZHOU, Yi-chao ZANG, Jun-hu ZHU, et al. NIG-AP: a new method for automated penetration testing[J]. Frontiers of Information Technology & Electronic Engineering, 2019, 20(9): 1277-1288. DOI： 10.1631/FITEE.1800532.

摘要

渗透测试在发现网络脆弱性与评估网络安全状态方面发挥着重要作用。但是，渗透测试过程只能由安全专家进行，造成了大量时间、人力开销。自动化渗透测试为解决该问题提供了思路，其中最为关键的是攻击规划。不少学者对攻击路径发现进行了大量深入研究，但是大都基于完备的网络拓扑信息，这与实际渗透测试情况不符。为了从攻击者视角发现网络中存在的所有攻击路径，提出一种基于网络信息增益的攻击规划算法（NIG-AP），该算法将渗透测试过程形式化为马尔科夫决策过程，并利用网络信息构建回报函数，并指导代理从入侵者角度发现隐藏的攻击路径，选择最佳响应操作。实验结果表明本文提出的算法能够有效提高攻击路径发现效率。

Abstract

Penetration testing offers strong advantages in the discovery of hidden vulnerabilities in a network and assessing network security. However

it can be carried out by only security analysts

which costs considerable time and money. The natural way to deal with the above problem is automated penetration testing

the essential part of which is automated attack planning. Although previous studies have explored various ways to discover attack paths

all of them require perfect network information beforehand

which is contradictory to realistic penetration testing scenarios. To vividly mimic intruders to find all possible attack paths hidden in a network from the perspective of hackers

we propose a network information gain based automated attack planning (NIG-AP) algorithm to achieve autonomous attack path discovery. The algorithm formalizes penetration testing as a Markov decision process and uses network information to obtain the reward

which guides an agent to choose the best response actions to discover hidden attack paths from the intruder's perspective. Experimental results reveal that the proposed algorithm demonstrates substantial improvement in training time and effectiveness when mining attack paths.

关键词

Keywords

references

AS Alexander Pretschner . . Automated Attack Planning Using a Partially Observable Model for Penetration Testing of Industrial Control Systems . . MS Thesis, Technische Universität München, München, Germany , , 2017 . . .

M Backes , , , J Hoffmann , , , R Künnemann , , , 等 . . Simulated penetration testing and mitigation analysis . . 2017 . . https://arxiv.org/abs/1705.05088v1 https://arxiv.org/abs/1705.05088v1 , , . .

DC Baulcombe . . Fast forward genetics based on virus-induced gene silencing . . Curr Opin Plant Biol , , 1999 . . 2 ( ( 2 ): ): 109 - - 113 . . DOI: 10.1016/S1369-5266(99)80022-3 http://doi.org/10.1016/S1369-5266(99)80022-3 . .

J Beale , , , H Meer , , , C van der Walt , , , 等 . . Nessus Network Auditing: Jay Beale Open Source Security Series . . Elsevier, Amsterdam, the Netherlands , , 2004 . . .

I Chadès , , , G Chapron , , , MJ Cros , , , 等 . . MDPtoolbox: a multi-platform toolbox to solve stochastic dynamic programming problems . . Ecography , , 2014 . . 37 ( ( 9 ): ): 916 - - 920 . . DOI: 10.1111/ecog.00888 http://doi.org/10.1111/ecog.00888 . .

Security Core . . Core Impact Penetration System . . 2019 . . [Accessed on Feb. 23, 2019] https://www.secureauth.com/products/penetration-testing/core-impact https://www.secureauth.com/products/penetration-testing/core-impact , , . .

M Fox , , , D Long . . PDDL2.1: an extension to PDDL for expressing temporal planning domains . . J Artif Intell Res , , 2003 . . 20 61 - - 124 . . DOI: 10.1613/jair.1129 http://doi.org/10.1613/jair.1129 . .

A Futoransky , , , L Notarfrancesco , , , G Richarte , , , 等 . . Building computer network attacks . . 2010 . . https://arxiv.org/abs/1006.1916 https://arxiv.org/abs/1006.1916 , , . .

F Holik , , , J Horalek , , , O Marik , , , 等 . . Effective penetration testing with metasploit framework and methodologies . . IEEE 15 th Int Symp on Computational Intelligence and Informatics , , 2014 . . p.237 - - 242 . . DOI: 10.1109/CINTI.2014.7028682 http://doi.org/10.1109/CINTI.2014.7028682 . .

S Khan , , , S Parkinson . . Towards automated vulnerability assessment . . 27 th Int Conf on Automated Planning and Scheduling , , 2017 . . p.33 - - 40 . . . .

DP Kingma , , , J Ba . . Adam: a method for stochastic optimization . . 2014 . . https://arxiv.org/abs/1412.6980 https://arxiv.org/abs/1412.6980 , , . .

H Kurniawati , , , D Hsu , , , WS Lee . . SARSOP: efficient point-based POMDP planning by approximating optimally reachable belief spaces . . In: Brock O, Trinkle J, Ramos F (Eds.), Robotics: Science and Systems IV. MIT Press, Massachusetts, USA, Chapter 10 , , 2008 . . .

C Lee , , , GG Lee . . Information gain and divergence-based feature selection for machine learning-based text categorization . . Inform Process Manag , , 2006 . . 42 ( ( 1 ): ): 155 - - 165 . . DOI: 10.1016/j.ipm.2004.08.006 http://doi.org/10.1016/j.ipm.2004.08.006 . .

JY Liang , , , ZZ Shi . . The information entropy, rough entropy and knowledge granulation in rough set theory . . Int J Uncert Fuzzy Knowl Syst , , 2004 . . 12 ( ( 1 ): ): 37 - - 46 . . DOI: 10.1142/S0218488504002631 http://doi.org/10.1142/S0218488504002631 . .

V Mnih , , , K Kavukcuoglu , , , D Silver , , , 等 . . Playing Atari with deep reinforcement learning . . 2013 . . https://arxiv.org/abs/1312.5602 https://arxiv.org/abs/1312.5602 , , . .

V Mnih , , , K Kavukcuoglu , , , D Silver , , , 等 . . Human-level control through deep reinforcement learning . . Nature , , 2015 . . 518 ( ( 7540 ): ): 529 - - 533 . . DOI: 10.1038/nature14236 http://doi.org/10.1038/nature14236 . .

JL Obes , , , C Sarraute , , , G Richarte . . Attack planning in the real world . . 2013 . . https://arxiv.org/abs/1306.4044 https://arxiv.org/abs/1306.4044 , , . .

M Roberts , , , A Howe , , , I Ray , , , 等 . . Personalized vulnerability analysis through automated planning . . Proc Int Joint Conf on Artificial Intelligence , , 2011 . . p.50 - - 57 . . . .

N Samant . . Automated Penetration Testing . . MS Thesis, San Jose State University, California, USA , , 2011 . . .

C Sarraute , , , G Richarte , , , Obes J Lucángeli . . An algorithm to find optimal attack paths in nondeterministic scenarios . . 4 th ACM Workshop on Security and Artificial Intelligence , , 2011 . . p.71 - - 80 . . DOI: 10.1145/2046684.2046695 http://doi.org/10.1145/2046684.2046695 . .

C Sarraute , , , O Buffet , , , J Hoffmann . . POMDPs make better hackers: accounting for uncertainty in penetration testing . . 26 th AAAI Conf on Artificial Intelligence , , 2012 . . p.1816 - - 1824 . . . .

C Sarraute , , , O Buffet , , , J Hoffmann . . Penetration testing = = POMDP solving . . 2013 . . https://arxiv.org/abs/1306.4714 https://arxiv.org/abs/1306.4714 , , . .

B Schneier . . Attack trees . . Dr Dobb's J , , 1999 . . 24 ( ( 12 ): ): 21 - - 29 . . . .

O Sheyner , , , J Haines , , , S Jha , , , 等 . . Automated generation and analysis of attack graphs . . IEEE Symp on Security and Privacy , , 2002 . . p.273 - - 284 . . DOI: 10.1109/SECPRI.2002.1004377 http://doi.org/10.1109/SECPRI.2002.1004377 . .

D Shmaryahu , , , G Shani , , , J Hoffmann , , , 等 . . Partially observable contingent planning for penetration testing . . 1 th Int Workshop on Artificial Intelligence in Security , , 2017 . . p.33 - - 40 . . . .

Y Stefinko , , , A Piskuzub . . Theory of modern penetration testing expert system . . Inform Process Syst , , 2017 . . 148 ( ( 2 ): ): 129 - - 133 . . DOI: 10.30748/soi.2017.148.25 http://doi.org/10.30748/soi.2017.148.25 . .

M Steinmetz . . Critical constrained planning and an application to network penetration testing . . 26 th Int Conf on Automated Planning and Scheduling , , 2016 . . p.141 - - 144 . . . .

RS Sutton , , , AG Barto . . Reinforcement Learning: an Introduction . . MIT Press, Cambridge, London , , 1998 . . .

C Szepesvári . . Algorithms for Reinforcement Learning . . Morgan & Claypool Publishers, San Rafael, Argentina , , 2010 . . .

YT Zhuang , , , F Wu , , , C Chen , , , 等 . . Challenges and opportunities: from big data to knowledge in AI 2.0 . . Front Inform Technol Electron Eng , , 2017 . . 18 ( ( 1 ): ): 3 - - 14 . . DOI: 10.1631/FITEE.1601883 http://doi.org/10.1631/FITEE.1601883 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Jiu fusion artificial intelligence (JFA): a two-stage reinforcement learning model with hierarchical neural networks and human knowledge for Tibetan Jiu chess

Efficient learning of robust multigait quadruped locomotion for minimizing the cost of transport

Reinforcement learning based privacy-preserving consensus tracking control of nonstrict-feedback discrete-time multi-agent systems

Domain adaptation in reinforcement learning: a comprehensive and systematic study

Multi-agent reinforcement learning behavioral control for nonlinear second-order systems