Automated Computer Network Exploitation with Bayesian Decision Networks

Abstract

Penetration Testing (pentesting) is the process, tactics and techniques to penetrate computer systems and networks to expose cybersecurity issues. It is currently a manual process requiring significant experience and time that are in limited supply. One way to reduce time is through automation. This paper presents the Automated Network Discovery and Exploitation System (ANDES) which demonstrates the feasibility to automate the pentesting process. Uniqueness to ANDES is the use and updating of Bayesian decision networks to represent the pentesting domain and subject matter expert knowledge and processes. Each iteration begins by modeling the current belief state for each system using a Bayesian decision networks. ANDES uses these networks to select and execute an expected best action. This process simulates the iterative thinking process of human attackers as they access and move through an enterprise network. Testing used a virtual network environment designed to mimic a small businesss internal network. ANDES successfully performed a series of information gathering and remote exploit actions, across multiple network hosts, to gain access to the objective target.