# A Unified Modeling Framework for Automated Penetration Testing

arXiv: https://arxiv.org/abs/2502.11588 · HTML: https://mlsanity.com/paper/2502.11588/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 17 of its 95 references that are in the map.
- First posted on arXiv 17 Feb 2025.

## Builds on (most cited first, 17 of 17)

- [AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks](https://mlsanity.com/paper/2403.01038/) (2024)
- [Autonomous Penetration Testing using Reinforcement Learning](https://mlsanity.com/paper/1905.05965/) (2019)
- [Finding Effective Security Strategies through Reinforcement Learning and Self-Play](https://mlsanity.com/paper/2009.08120/) (2020)
- [POMDPs Make Better Hackers: Accounting for Uncertainty in Penetration Testing](https://mlsanity.com/paper/1307.8182/) (2013)
- [Penetration Testing == POMDP Solving?](https://mlsanity.com/paper/1306.4714/) (2013)
- [Attack Planning in the Real World](https://mlsanity.com/paper/1306.4044/) (2013)
- [Simulating SQL Injection Vulnerability Exploitation Using Q-Learning Reinforcement Learning Agents](https://mlsanity.com/paper/2101.03118/) (2021)
- [BreachSeek: A Multi-Agent Automated Penetration Tester](https://mlsanity.com/paper/2409.03789/) (2024)
- [HARMer: Cyber-attacks Automation and Evaluation](https://mlsanity.com/paper/2006.14352/) (2020)
- [Automated Adversary Emulation for Cyber-Physical Systems via Reinforcement Learning](https://mlsanity.com/paper/2011.04635/) (2020)
- [Knowledge-Informed Auto-Penetration Testing Based on Reinforcement Learning with Reward Machine](https://mlsanity.com/paper/2405.15908/) (2024)
- [Evaluation of Reinforcement Learning for Autonomous Penetration Testing using A3C, Q-learning and DQN](https://mlsanity.com/paper/2407.15656/) (2024)
- [An Algorithm to Find Optimal Attack Paths in Nondeterministic Scenarios](https://mlsanity.com/paper/1306.4040/) (2013)
- [Automated Attack Planning](https://mlsanity.com/paper/1307.7808/) (2013)
- [Why Charles Can Pen-test: an Evolutionary Approach to Vulnerability Testing](https://mlsanity.com/paper/2011.13213/) (2020)
- [Towards Automated Attack Simulations of BPMN-based Processes](https://mlsanity.com/paper/2106.08568/) (2021)
- ['PeriHack': Designing a Serious Game for Cybersecurity Awareness](https://mlsanity.com/paper/2208.00235/) (2022)

## Built on by (most cited first, 1 of 1)

- [RapidPen: Fully Automated IP-to-Shell Penetration Testing with LLM-based Agents](https://mlsanity.com/paper/2502.16730/) (2025)

## Abstract (arXiv)

The integration of artificial intelligence into automated penetration testing (AutoPT) has highlighted the necessity of simulation modeling for the training of intelligent agents, due to its cost-efficiency and swift feedback capabilities. Despite the proliferation of AutoPT research, there is a recognized gap in the availability of a unified framework for simulation modeling methods. This paper presents a systematic review and synthesis of existing techniques, introducing MDCPM to categorize studies based on literature objectives, network simulation complexity, dependency of technical and tactical operations, and scenario feedback and variation. To bridge the gap in unified method for multi-dimensional and multi-level simulation modeling, dynamic environment modeling, and the scarcity of public datasets, we introduce AutoPT-Sim, a novel modeling framework that based on policy automation and encompasses the combination of all sub dimensions. AutoPT-Sim offers a comprehensive approach to modeling network environments, attackers, and defenders, transcending the constraints of static modeling and accommodating networks of diverse scales. We publicly release a generated standard network environment dataset and the code of Network Generator. By integrating publicly available datasets flexibly, support is offered for various simulation modeling levels focused on policy automation in MDCPM and the network generator help researchers output customized target network data by adjusting parameters or fine-tuning the network generator.