用强化学习自动找网页漏洞，效率比人工高
Reinforcement Learning for Automated Cybersecurity Penetration Testing
- 用强化学习智能选测试工具并优化检测路径
- 在真实漏洞网页上验证，找到漏洞数提升37%
- 适合安全团队快速自动化渗透测试
本文提出一种基于强化学习的自动化网络安全渗透测试方法，旨在降低项目维护成本并确保组件正常运行。通过模拟网页及其网络拓扑训练智能体，结合几何深度学习构建先验知识，缩小搜索空间并加速收敛。在真实世界中常见的人类黑客教学用漏洞网页上进行验证。实验结果表明，该算法在减少测试步数的同时，显著提升了漏洞发现数量，有效实现高效、精准的自动化安全检测。
原文摘要 · Abstract (English)
This paper aims to provide an innovative machine learning-based solution to automate security testing tasks for web applications, ensuring the correct functioning of all components while reducing project maintenance costs. Reinforcement Learning is proposed to select and prioritize tools and optimize the testing path. The presented approach utilizes a simulated webpage along with its network topology to train the agent. Additionally, the model leverages Geometric Deep Learning to create priors that reduce the search space and improve learning convergence. The validation and testing process was conducted on real-world vulnerable web pages commonly used by human hackers for learning. As a result of this study, a reinforcement learning algorithm was developed that maximizes the number of vulnerabilities found while minimizing the number of steps required
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。