Intelligent Penetration Path Planning and Solution Optimization Based on Reinforcement Learning
In the background of the widespread application of big data technology,the problems that traditional penetration tes-ting overly relies on expert experience and manual operation have become more significant.Automated penetration testing aims to solve the above problems,so as to discover system security vulnerabilities more accurately and comprehensively.Finding the opti-mal penetration path is the most important task in automated penetration testing.However,current mainstream research suffers from the following problems:1)seeking the optimal path in the original solution space,which contains numberous redundant paths,significantly increases the complexity of problem-solving;2)evaluation of vulnerability exploitation and positive reward ob-tainment actions is not enough.The problem-solving can be optimized by eliminating a significant number of redundant penetra-tion paths and employing exploit sample enhancement and positive reward sample enhancement methods.Therefore,this paper proposes the MASK-SALT-DQN algorithm by integrating solution space transformation and sample enhancement methods.It qualitatively and quantitatively analyzes the influence of the proposed algorithm on the model solving process,proposing the com-pression ratio to measure the benefits of solution space transformation.Experiments indicate that the proportion of redundant so-lution paths in the original solution space consistently remains over 83％,proving the necessity of solution space transformation.In addition,in standard experiment scenario,the theoretical compression ratio is 57.2,and the error between the experimental compression ratio and theoretical value is only 1.40％.Moreover,in comparison to baseline methods,MASK-SALT-DQN has the optimal performance in all experiment scenarios,which confirms its the effectiveness and superiority.
Penetration path planningReinforcement learningSolution space transformationSample enhancementCompression ratio
万方数据
维普
