# Attack Planning in the Real World

arXiv: https://arxiv.org/abs/1306.4044 · HTML: https://mlsanity.com/paper/1306.4044/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 18 Jun 2013.

## Built on by (most cited first, 8 of 8)

- [PentestAgent: Incorporating LLM Agents to Automated Penetration Testing](https://mlsanity.com/paper/2411.05185/) (2024)
- [Automated Penetration Testing with LLM Agents and Classical Planning](https://mlsanity.com/paper/2512.11143/) (2025)
- [A Unified Modeling Framework for Automated Penetration Testing](https://mlsanity.com/paper/2502.11588/) (2025)
- [Improving Search by Utilizing State Information in OPTIC Planners Compilation to LP](https://mlsanity.com/paper/2106.07924/) (2021)
- [Planning with Dynamically Estimated Action Costs](https://mlsanity.com/paper/2206.04166/) (2022)
- [CloudLens: Modeling and Detecting Cloud Security Vulnerabilities](https://mlsanity.com/paper/2402.10985/) (2024)
- [Symbolic Attack Chain Generation from Atomic Red Team Techniques: An Empirical Study of Predicate Representation Granularity](https://mlsanity.com/paper/2608.00143/) (2026)
- [CVE2AP: Automated Generation of PDDL-Encoded Attack Paths via Large Language Models](https://mlsanity.com/paper/2610.03383/) (2026)

## Abstract (arXiv)

Assessing network security is a complex and difficult task. Attack graphs have been proposed as a tool to help network administrators understand the potential weaknesses of their network. However, a problem has not yet been addressed by previous work on this subject; namely, how to actually execute and validate the attack paths resulting from the analysis of the attack graph. In this paper we present a complete PDDL representation of an attack model, and an implementation that integrates a planner into a penetration testing tool. This allows to automatically generate attack paths for penetration testing scenarios, and to validate these attacks by executing the corresponding actions -including exploits- against the real target network. We present an algorithm for transforming the information present in the penetration testing tool to the planning domain, and show how the scalability issues of attack graphs can be solved using current planners. We include an analysis of the performance of our solution, showing how our model scales to medium-sized networks and the number of actions available in current penetration testing tools.