用AI自动化渗透测试，提升效率与可扩展性。
PenTest++: Elevating Ethical Hacking with AI and Automation
- 融合生成式AI与自动化，优化渗透测试全流程。
- 在虚拟环境中实现侦察到文档的端到端流程自动化。
- 适合安全团队提升效率，也需关注隐私与幻觉风险。
传统道德黑客依赖专业人员和耗时的手动指令管理，限制了其可扩展性和效率。为应对这些挑战，我们提出PenTest++，一个结合自动化与生成式AI（GenAI）的AI增强系统，旨在优化渗透测试工作流。该系统在受控虚拟环境中开发，实现了侦察、扫描、枚举、利用和文档生成等关键任务的自动化，同时保持模块化和可适应性设计。系统在关键阶段保留人工监督，确保决策知情，显著提升了效率、可扩展性和适应性。然而，也引发隐私担忧及AI生成错误（幻觉）的风险。本研究强调类似PenTest++的AI驱动系统能有效辅助人类专家，通过自动化常规任务，使安全人员专注于战略决策。通过引入严格的伦理保障并持续优化，证明了AI可在负责任的前提下应对网络安全领域不断演变的操作与伦理挑战。
原文摘要 · Abstract (English)
Traditional ethical hacking relies on skilled professionals and time-intensive command management, which limits its scalability and efficiency. To address these challenges, we introduce PenTest++, an AI-augmented system that integrates automation with generative AI (GenAI) to optimise ethical hacking workflows. Developed in a controlled virtual environment, PenTest++ streamlines critical penetration testing tasks, including reconnaissance, scanning, enumeration, exploitation, and documentation, while maintaining a modular and adaptable design. The system balances automation with human oversight, ensuring informed decision-making at key stages, and offers significant benefits such as enhanced efficiency, scalability, and adaptability. However, it also raises ethical considerations, including privacy concerns and the risks of AI-generated inaccuracies (hallucinations). This research underscores the potential of AI-driven systems like PenTest++ to complement human expertise in cybersecurity by automating routine tasks, enabling professionals to focus on strategic decision-making. By incorporating robust ethical safeguards and promoting ongoing refinement, PenTest++ demonstrates how AI can be responsibly harnessed to address operational and ethical challenges in the evolving cybersecurity landscape.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。