论大型语言模型在渗透测试中出人意料的有效性
On the Surprising Efficacy of LLMs for Penetration-Testing
AI总结：
本文批判性审查了大型语言模型在渗透测试中的有效性，梳理其在攻防安全任务中的应用，分析其有效的关键因素，并探讨了阻碍安全部署的模型可靠性、成本及伦理等重大障碍。
摘要：
本文对大型语言模型（LLMs）在渗透测试中出人意料的有效性进行了批判性审查。论文全面回顾了LLMs的演进及其迅速扩展的能力，这些能力使其日益适合复杂的渗透测试操作。文章系统详细地梳理了学术界和工业界采用LLMs的历史，展示了其在各种攻击性安全任务中的应用，并覆盖了网络杀伤链的更广泛阶段。至关重要的是，分析还延伸至恶意行为者对LLMs的观察性采用，强调了这项技术在安全领域内固有的双重用途挑战。\nLLMs在此背景下的意外有效性可由几个关键因素阐明：渗透测试对模式匹配的依赖与LLMs核心优势之间的强一致性、其在动态环境中管理不确定性的固有能力，以及通过LLM提供商以高性价比获取胜任的预训练模型。\n当前LLM辅助渗透测试的格局被归类为交互式的“vibe-hacking”和完全自主系统的兴起。论文识别并讨论了阻碍其更广泛采用和安全部署的重大障碍。这些障碍包括关于模型可靠性和稳定性的关键问题、至关重要的安全与保障担忧、巨大的经济与生态成本、对隐私和数字主权的影响、复杂的问责问题，以及深刻的伦理困境。这项全面的审查与分析为讨论AI与安全交叉领域的未来研究方向和稳健保障措施的开发奠定了基础。
英文摘要：
This paper presents a critical examination of the surprising efficacy of Large Language Models (LLMs) in penetration testing. The paper thoroughly reviews the evolution of LLMs and their rapidly expanding capabilities which render them increasingly suitable for complex penetration testing operations. It systematically details the historical adoption of LLMs in both academic research and industry, showcasing their application across various offensive security tasks and covering broader phases of the cyber kill chain. Crucially, the analysis also extends to the observed adoption of LLMs by malicious actors, underscoring the inherent dual-use challenge of this technology within the security landscape. The unexpected effectiveness of LLMs in this context is elucidated by several key factors: the strong alignment between penetration testing's reliance on pattern-matching and LLMs' core strengths, their inherent capacity to manage uncertainty in dynamic environments, and cost-effective access to competent pre-trained models through LLM providers. The current landscape of LLM-aided penetration testing is categorized into interactive 'vibe-hacking' and the emergence of fully autonomous systems. The paper identifies and discusses significant obstacles impeding wider adoption and safe deployment. These include critical issues concerning model reliability and stability, paramount safety and security concerns, substantial monetary and ecological costs, implications for privacy and digital sovereignty, complex questions of accountability, and profound ethical dilemmas. This comprehensive review and analysis provides a foundation for discussion on future research directions and the development of robust safeguards at the intersection of AI and security.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
