Automated Penetration Testing via PDDL Attack Planning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current penetration testing frameworks face challenges in managing complexity, especially in medium-sized networks, as they struggle to build and store complete attack graphs due to exponential memory requirements, making it difficult to model and analyze attack paths effectively.
Innovation Solution
The system translates a conceptual attack model into Planning Domain Definition Language (PDDL) representation and uses classical planning algorithms to find attack paths without constructing the entire graph, thereby avoiding combinatorial explosion and making penetration testing more accessible and efficient.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If complete attack graphs are built and stored to model attack paths, then attack path analysis capability is improved, but memory requirements increase exponentially
Solution Approach 1:
The patent divides the attack graph into smaller subgraphs based on vulnerability types and attack patterns. Instead of building one complete attack graph for the entire network, the system segments it into manageable portions that can be analyzed independently and then integrated, reducing peak memory requirements while maintaining comprehensive attack path coverage.
Solution Approach 2:
The system performs preliminary analysis to identify and store only the critical attack paths and vulnerable assets before conducting full penetration testing. By pre-processing network topology and vulnerability data to extract essential attack sequences, the system reduces the complexity of graphs that need to be held in memory during actual testing operations.
2Adaptability or versatility
If penetration testing frameworks are extended to cover new attack vectors and modules, then security assessment completeness is improved, but system complexity increases
Solution Approach 1:
The patent implements a universal attack graph data structure and analysis engine that can handle multiple vulnerability types and attack vectors through a single unified framework. Instead of creating separate specialized tools for different attack patterns, the system uses a multi-functional platform that adapts to various assault scenarios, reducing overall system complexity while maintaining comprehensive coverage.
Solution Approach 2:
The system introduces an intermediary layer consisting of standardized interfaces and abstraction mechanisms between the diverse attack modules and the core analysis engine. This intermediary layer allows new attack vectors and modules to be integrated without directly increasing the complexity of the core framework, as the intermediary handles the adaptation and coordination.
3Productivity
If automated penetration testing is performed without complete network knowledge, then testing efficiency is improved, but measurement precision of attack paths decreases
Solution Approach 1:
The patent implements a dynamic attack graph construction approach where the graph structure and content adapt based on the current state of information gathering during penetration testing. As the automated tester discovers new assets and vulnerabilities, the attack graph dynamically updates to reflect the current knowledge state, allowing efficient progressive testing while maintaining accurate attack path models based on available information.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for extending automated penetration testing of a target network is provided. The method comprises: computing a scenario, comprises the steps of: translating a workspace having at least one target computer in the target network, to a planning definition language, translating penetration modules available in a penetration testing framework to a planning definition language, and defining a goal in the target network and translating the goal into a planning definition language; building a knowledge database with information regarding the target network, properties of hosts in the network, parameters and running history of modules in the penetration testing framework; and running an attack plan solver module, comprising: running an attack planner using the scenario as input, to produce at least one attack plan that achieves the goal, and executing actions defined in the at least one attack plan against the target network from the penetration testing framework.