부산대학교 도서관

Penetration testing (PT) is the best method for vulnerabilities assessment and evaluating the security of the system under test, by planning and generating possible attack exploits, consist of a series of complex and time consuming trial-and-error stages. Many automated Pentest tools have made. Current Reinforce Learning (RL) based PT tools can do systematic and regular tests to save human resources. Without the aid of prior knowledge, RL-based penetration is somehow more like brute-force test. In this paper, we propose a novel ontology based BDI-agent RL automatic PT framework. By combining SWRL penetration testing knowledge base and RL in a BDI (belief-desire-intention) agent, the proposed model can make use of the ontology based knowledge base (prior knowledge) to optimize the planning problem in the uncertain and dynamic environment. Finally, the simulation on ASL simulation platform Jason proved the new BDI-agent auto-PT model can improve the accuracy and speed performance.