arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2509.20008cs.LGcs.CR
收藏

学习部分可观测下的鲁棒渗透测试策略:系统评估

Learning Robust Penetration Testing Policies under Partial Observability: A systematic evaluation

Cyber Defence Lab, CISS Department Royal Military Academy(国防网络安全实验室,信息与系统科学系皇家军事学院);AI Lab, Department of Computer Science Vrije Universiteit Brussel(人工智能实验室,计算机科学系自由大学布鲁塞尔)

Raphael Simon, Pieter Libin, Wim Mees

AI总结:

针对部分可观测的渗透测试问题,系统评估了多种PPO变体(如帧堆叠、历史观测增强、LSTM/TrXL架构)在主机网络中的性能,发现历史聚合策略收敛速度提升四倍,并揭示了策略的定性差异。

摘要:

渗透测试,即模拟网络攻击以识别安全漏洞,是一个适合强化学习(RL)自动化的序列决策问题。与RL在现实问题中的许多应用一样,部分可观测性是一个主要挑战,因为它破坏了马尔可夫决策过程(MDP)中的马尔可夫性质。部分可观测MDP需要历史聚合或信念状态估计来学习成功的策略。我们研究了不同大小主机网络上的随机、部分可观测渗透测试场景,旨在通过更具挑战性和代表性的基准更好地反映现实世界的复杂性。这种方法有助于开发更鲁棒和可迁移的策略,这对于确保在多样且不可预测的现实环境中可靠性能至关重要。以普通近端策略优化(PPO)为基线,我们比较了一系列旨在缓解部分可观测性的PPO变体,包括帧堆叠、用历史信息增强观测,以及使用LSTM或TrXL架构。我们对这些算法在不同主机网络规模上进行了系统的实证分析。我们发现该任务从历史聚合中获益巨大,收敛速度比其他方法快四倍。对算法所学策略的手动检查揭示了明显的区别,并提供了超越定量结果的见解。

英文摘要:

Penetration testing, the simulation of cyberattacks to identify security vulnerabilities, presents a sequential decision-making problem well-suited for reinforcement learning (RL) automation. Like many applications of RL to real-world problems, partial observability presents a major challenge, as it invalidates the Markov property present in Markov Decision Processes (MDPs). Partially Observable MDPs require history aggregation or belief state estimation to learn successful policies. We investigate stochastic, partially observable penetration testing scenarios over host networks of varying size, aiming to better reflect real-world complexity through more challenging and representative benchmarks. This approach leads to the development of more robust and transferable policies, which are crucial for ensuring reliable performance across diverse and unpredictable real-world environments. Using vanilla Proximal Policy Optimization (PPO) as a baseline, we compare a selection of PPO-based variants designed to mitigate partial observability, including frame-stacking, augmenting observations with historical information, and employing LSTM or TrXL architectures. We conduct a systematic empirical analysis of these algorithms across different host network sizes. We find that this task greatly benefits from history aggregation. Converging up to four times faster than other approaches. Manual inspection of the learned policies by the algorithms reveals clear distinctions and provides insights that go beyond quantitative results.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑