Penetration Testing Automation with Inverse Soft-Q Learning: An Imitation Learning Method

Sammanfattning

Penetration testing (PT) is a useful technique for vulnerability mining and cybersecurity management that mimics a real hacker’s attack to get vital information from operating systems or make the system inaccessible to users. Given that traditional manual PT relies heavily on specialists’ subject knowledge and is highly time-consuming, its cost is high. Artificial intelligence algorithms like reinforcement learning (RL) and deep reinforcement learning (DRL) have been studied and used in PT to provide efficient and cost-effective methods to handle the challenge. However, existing algorithms are either not able to handle large action and environment spaces or are difficult to train. To solve this, this thesis uses the Inverse Soft-Q Learning (IQ-Learn) algorithm in PT automation, a \emph{state-of-the-art} (SOTA) Imitation Learning algorithm, to lower the training difficulty and improve performance. To be more specific, an artefact is designed and implemented with the design science framework as methodology. The artefact involves generating an expert knowledge base that consists of state-action pairs by interacting with the environment and training the artificial agent with expert data. The artefact is evaluated with extensive simulated experiments. The result shows that the artefact can improve the performance of PT automation.