Prompt. Exploit. Repeat: Automating Network Security Testing with LLMs

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21230%2F25%3A00383332" target="_blank" >RIV/68407700:21230/25:00383332 - isvavai.cz</a>

Result on the web

<a href="https://doi.org/10.1007/978-3-031-87330-0_2" target="_blank" >https://doi.org/10.1007/978-3-031-87330-0_2</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1007/978-3-031-87330-0_2" target="_blank" >10.1007/978-3-031-87330-0_2</a>

Result language

angličtina

Original language name

Prompt. Exploit. Repeat: Automating Network Security Testing with LLMs

Original language description

Large Language Models (LLMs) have demonstrated remarkable capabilities in various tasks, but their potential in cybersecurity remains largely unexplored. Despite their inherent limitations, LLM-based designs have shown promising ability in planning and navigating open-world scenarios. This paper investigates the application of pre-trained LLMs as agents in network security environments, a domain traditionally dominated by reinforcement learning (RL) approaches. We introduce a novel method that leverages LLMs for sequential decision-making in cybersecurity scenarios, that is flexible and does not need re-training to adapt to new scenarios. Our study employs two distinct environments: Microsoft’s CyberBattleSim and our newly developed NetSecGame, which incorporates more realistic network conditions and a defender component. We compare the performance of LLM agents, against traditional reinforcement learning agents across various scenarios. Results show that the best LLM agents achieve success rates of 100% in undefended scenarios and up to 53.3% in the most challenging defended scenarios, outperforming conventional RL agents without requiring additional training. Furthermore, we present NetSecGame, a modular and scalable network security environment that addresses the limitations of existing platforms by providing more realistic conditions for testing attacking and defending agents. This research demonstrates the potential of LLMs in cybersecurity applications, offering a flexible and efficient alternative to traditional RL approaches in network security testing.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

<a href="/en/project/VJ02010020" target="_blank" >VJ02010020: AI-Dojo: Multiagent Testbed for Research and Testing of AI-driven Cybersecurity Technologies</a><br>

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2025

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

Agents and Artificial Intelligence

ISBN

978-3-031-87329-4

ISSN

0302-9743

e-ISSN

—

Number of pages

22

Pages from-to

15-36

Publisher name

Springer, Cham

Place of publication

—

Event location

Rome

Event date

Feb 24, 2024

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

—