Intelligent Penetration Testing in Dynamic Defense Environment

Abstract

Intelligent penetration testing (PT) becomes a hotspot. However, the existing intelligent PT environment is static and determined, which does not fully consider the impact of dynamic defense. To improve the fidelity of the existing simulation environment, in this paper, we conduct intelligent PT in a dynamic defense environment based on reinforcement learning (RL). First, the simulation details of intelligent PT in a dynamic defense environment are introduced. Second, we incorporate dynamic defense to the nodes of the network topology. Then we evaluate our proposed method by using the Chain scenario of CyberbattleSim with and without dynamic defense. We also conduct the environment in a larger-scale network scenario. And we analyze the efficiency of different parameters of the RL algorithm. The experimental results show that the average cumulative rewards have decreased obviously in a dynamic defense environment. As the number of nodes increases, it becomes more difficult for an agent to converge in this case. Additionally, it's recommended that an agent adopts a compromise of exploration and exploitation when observing a dynamic environment.