🤖 AI Summary
To address the low automation level, high maintenance cost, and inefficient path exploration in web application penetration testing, this paper proposes an automated security testing framework integrating reinforcement learning (RL) with geometric deep learning. Methodologically, we design a graph neural network (GNN)-based agent that perceives web topology and leverages geometric priors to compress the action space, enabling joint optimization of tool selection and penetration path planning. The agent is co-trained and validated in both simulated environments and real vulnerable web applications (e.g., WebGoat). To the best of our knowledge, this is the first work embedding GNNs into an RL framework for penetration path planning. Experimental results demonstrate a 32.7% increase in vulnerability detection rate and a 41.5% reduction in average detection steps, significantly improving both testing efficiency and maintainability.
📝 Abstract
This paper aims to provide an innovative machine learning-based solution to automate security testing tasks for web applications, ensuring the correct functioning of all components while reducing project maintenance costs. Reinforcement Learning is proposed to select and prioritize tools and optimize the testing path. The presented approach utilizes a simulated webpage along with its network topology to train the agent. Additionally, the model leverages Geometric Deep Learning to create priors that reduce the search space and improve learning convergence. The validation and testing process was conducted on real-world vulnerable web pages commonly used by human hackers for learning. As a result of this study, a reinforcement learning algorithm was developed that maximizes the number of vulnerabilities found while minimizing the number of steps required