Analysis of Autonomous Penetration Testing Through Reinforcement Learning and Recommender Systems.

Area of Science:

• Cybersecurity
• Machine Learning
• Artificial Intelligence

Background:

• Penetration testing (pentesting) is vital for identifying IT vulnerabilities but faces challenges like false positives from analysis tools.
• Existing pentesting methods require significant analyst expertise due to complex and unpredictable environments.
• Machine Learning (ML) shows promise in anomaly detection but requires integration into dynamic pentesting workflows.

Purpose of the Study:

• To develop an intelligent system that enhances the effectiveness and accuracy of penetration testing.
• To address the limitations of current pentesting tools and methodologies.
• To propose a novel approach for automated vulnerability assessment and exploitation strategy selection.

Main Methods:

• A context-rich, vocabulary-aware transformer model processes questions about the target environment.
• A Reinforcement Learning (RL) estimator evaluates and selects optimal pentest strategies.
• The system dynamically explores attack vectors based on learned data and environmental context.

Main Results:

• The proposed system achieved an F1 score exceeding 97.0%.
• An Exact Match rate of over 97.0% was recorded, indicating high accuracy.
• Demonstrated effectiveness in selecting relevant and optimal pentesting strategies.

Conclusions:

• The developed system significantly improves the accuracy and efficiency of penetration testing.
• The integration of ML and RL offers a powerful solution for complex cybersecurity challenges.
• This approach enhances the identification of vulnerabilities and strengthens preventive controls in IT systems.