Please use this identifier to cite or link to this item: doi:10.22028/D291-29345
Volltext verfügbar? / Dokumentlieferung
Title: Simulated Penetration Testing as Contingent Planning
Author(s): Shmaryahu, Dorin
Shani, Guy
Hoffmann, Jörg
Steinmetz, Marcel
Editor(s): de Weerdt, Mathijs
Koenig, Sven
Röger, Gabriele
Spaan, Matthijs
Language: English
Title: Twenty-Eighth International Conference on Automated Planning and Scheduling
Startpage: 241
Endpage: 249
Publisher/Platform: AAAI Press
Year of Publication: 2018
Title of the Conference: ICAPS 2018
Place of the conference: Delft, The Netherlands
Publikation type: Conference Paper
Abstract: In penetration testing (pentesting), network administrators attack their own network to identify and fix vulnerabilities. Planning-based simulated pentesting can achieve much higher testing coverage than manual pentesting. A key challenge is for the attack planning to imitate human hackers as faithfully as possible. POMDP models have been proposed to this end, yet they are computationally very hard, and it is unclear how to acquire the models in practice. At the other extreme, classical planning models are scalable and simple to obtain, yet completely ignore the incomplete knowledge characteristic of hacking. We propose contingent planning as a new middle ground, feasible in both computation burden and model acquisition effort while allowing for a representation of incomplete knowledge. We design the model, show how to adapt available solvers, and show how to acquire the model from real network scans in practice. We experiment on real networks and show that our approach scales to practical input sizes.
URL of the first publication:
Link to this record: hdl:20.500.11880/28352
ISSN: 2334-0843
Date of registration: 22-Nov-2019
Faculty: MI - Fakultät für Mathematik und Informatik
Department: MI - Informatik
Professorship: MI - Prof. Dr. Jörg Hoffmann
Collections:Die Universitätsbibliographie

Files for this record:
There are no files associated with this item.

Items in SciDok are protected by copyright, with all rights reserved, unless otherwise indicated.