Abstract:

Selecting penetration actions based on policy networks and discovering the optimal attack path is a crucial technology in automated penetration testing. However, existing methods have issues such as excessive ineffective actions and slow convergence speed during the training process. To address these problems, this paper applied the proximal policy optimization (PPO) algorithm to the attack path optimization problem and proposed an improved version called improved PPO with penetration action selection (IPPOPAS) that incorporated a penetration action selection module. This module enabled the algorithm to select actions based on the penetration testing scenario during the experience collection phase. The paper designd and implemented various components of the IPPOPAS algorithm, including policy networks, value networks, and the penetration action selection module, to enhance the action selection process. Parameter tuning and algorithm optimization were also performed to improve the performance and efficiency of the algorithm. Experimental results demonstrate that the IPPOPAS algorithm achieves faster convergence speed compared to traditional DQN algorithms and their variations in specific network scenarios. Additionally, the algorithm exhibits even faster convergence speed with an increasing number of vulnerabilities in the host. Furthermore, the effectiveness of the IPPOPAS algorithm is validated in scenarios with expanded network scales.

Key words: automated penetration testing, policy network, PPO algorithm, attack path discovery