用智能体AI自动攻防测试，发现潜在漏洞。
RedTeamLLM: an Agentic AI framework for offensive security
- 分三步执行：总结、推理、行动，自动化渗透测试
- 在多道入门级但非平凡的CTF挑战中成功完成任务
- 解决计划修正、记忆管理等四大安全挑战，适合安全研究者
从自动化入侵测试到软件发布前发现零日漏洞，智能体人工智能在安全工程中展现出巨大潜力。然而，其强大能力也带来风险：安全与研究界必须在恶意行为者利用该技术进行网络犯罪之前，提前构建防御模型。为此，我们提出并评估了RedTeamLLM——一个集成化的安全框架，用于自动化渗透测试任务。该框架遵循“总结-推理-行动”三步流程，具备完整操作能力。该新架构解决了四个开放性挑战：计划修正、记忆管理、上下文窗口限制，以及通用性与专用性的平衡。通过自动化解决一系列入门级但非平凡的CTF挑战，对框架的推理能力进行了专门评估。
原文摘要 · Abstract (English)
From automated intrusion testing to discovery of zero-day attacks before software launch, agentic AI calls for great promises in security engineering. This strong capability is bound with a similar threat: the security and research community must build up its models before the approach is leveraged by malicious actors for cybercrime. We therefore propose and evaluate RedTeamLLM, an integrated architecture with a comprehensive security model for automatization of pentest tasks. RedTeamLLM follows three key steps: summarizing, reasoning and act, which embed its operational capacity. This novel framework addresses four open challenges: plan correction, memory management, context window constraint, and generality vs. specialization. Evaluation is performed through the automated resolution of a range of entry-level, but not trivial, CTF challenges. The contribution of the reasoning capability of our agentic AI framework is specifically evaluated.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。