基于 A3C、Q-learning 和 DQN 的自主渗透测试评估
摘要
渗透测试是通过模拟攻击来搜索安全弱点的过程。通常由有经验的专业人员执行，其中应用扫描和攻击工具。通过自动化执行此类工具， could reduce the need for human interaction and decision-making. In this work, a Network Attack Simulator (NASim) was used as an environment to train reinforcement learning agents to solve three predefined security scenarios. These scenarios cover techniques of exploitation, post-exploitation and wiretapping. A large hyperparameter grid search was performed to find the best hyperparameter combinations. The algorithms Q-learning, DQN and A3C were used, whereby A3C was able to solve all scenarios and achieve generalization. In addition, A3C could solve these scenarios with fewer actions than the baseline automated penetration testing. Although the training was performed on rather small scenarios and with small state and action spaces for the agents, the results show that a penetration test can successfully be performed by the RL agent.
关键词
引用
@article{arxiv.2407.15656,
title = {Evaluation of Reinforcement Learning for Autonomous Penetration Testing using A3C, Q-learning and DQN},
author = {Norman Becker and Daniel Reti and Evridiki V. Ntagiou and Marcus Wallum and Hans D. Schotten},
journal= {arXiv preprint arXiv:2407.15656},
year = {2024}
}