Researchers Pre-trained LLM Agents Acting as Human Penetration Testers

LLMs have already shown their exceptional abilities in mimicking human text abilities, but their potential reaches further. They now show promise in planning and open-world exploration, hinting at broader horizons.

The Large Language Models (LLMs) also bring promise to cybersecurity, especially in automating penetration testing. However, besides this, combining LLMs with decision-making adds exciting possibilities.

The following cybersecurity researchers from their respective universities have recently unveiled that they are proposing the pre-trained LLM agents acting as human testers:-

• Maria Rigaki (Czech Technical University in Prague)
• Ondrej Lukas (Czech Technical University in Prague)
• Carlos A. Catania (School of Engineering, National University of Cuyo)
• Sebastian Garcia (Czech Technical University in Prague)

Proposed Pre-trained LLM Agents

In NLP, the 2017 introduction of transformers was a game-changer, using self-attention for parallel sequence processing. 

Transformers have encoders and decoders, with self-attention capturing word importance and positional encodings preserving order.

Early pre-trained models like GPT-3 struggled with reasoning, but using prompts and in-context learning improved this. Chain of Thought (CoT) and a simple prompt like “Let’s think step by step” were practical for logical reasoning tasks.

LLMs enhance network security by countering social engineering attacks like phishing, baiting, and tailgating through text analysis, detecting unusual communication patterns as potential threats.

Existing network security training environments for reinforcement learning lack consistency in the following elements:-

• Network behavior
• Goals
• Defenders
• Reward systems

These critical factors often lack detailed discussion or explanation, raising concerns about their real-world applicability.

NetSecGame

NetSecGame (https://github.com/stratosphereips/NetSecGame) is an innovative simulated network security training ground and security environment with a defined topology, actions, goals, and code in a secret repository.

Apart from this, the NetSecGame has six main parts, and here below, we have mentioned those parts:-

• Configuration
• Action space
• State space
• Reward
• Goal
• Defensive agent.

NetSecGame employs two config files, and below, we have mentioned them:-

• One for network topology
• The other one is for RL behavior

Network Scenarios

Here below, we have mentioned all the network scenarios:-

• State Representation
• Action Representation
• Reward Function

In RL, LLMs get state ‘𝑠𝑡,’ provide ‘𝑎𝑡,’ and receive rewards without extra learning. LLMs are assumed to be knowledgeable in network security, with no episode-to-episode learning.

Experts chose the “chain” scenario in CyberbattleSim, with 10 nodes, for LLM testing due to its complexity and distinct goal among the three baseline scenarios.

Limitations

Here below, we have mentioned all the limitations:-

• Hallucination
• Invalid or repeated actions
• Cost
• Instability
• Prompt creation
• Learning

Despite LLM limitations, cybersecurity researchers see the potential for high-level cybersecurity planning, and not only that, even future work should explore complex scenarios.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.