Skip to main navigation Skip to search Skip to main content

Automated vulnerability modeling and verification for penetration testing using petri nets

  • Junchao Luan
  • , Jian Wang
  • , Mingfu Xue*
  • *Corresponding author for this work
  • Nanjing University of Aeronautics and Astronautics
  • Civil Aviation University of China

Research output: Chapter in Book/Report/Conference proceedingChapterpeer-review

Abstract

With the increase of network size, there are more and more potential vulnerabilities, which makes it difficult to conduct penetration testing in multihost networks. Attack graph is a useful tool for penetration testing to analyze the relevance of vulnerabilities between hosts and provides a visual view for attack path planning. However, previous works on attack graph generation are inefficient and not applicable to practical penetration testing process. In this paper, we propose an automated vulnerability modeling and verification approach for penetration testing, which generates attack graph efficiently and can be applied to attack process. Petri net is adopted for vulnerability modeling and attack graph synthesis. We implement a prototype system named Automatic Penetration Testing System to verify our method. The system is tested in real networks and the experiment results show the efficiency of our approach.

Original languageEnglish
Title of host publicationLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
PublisherSpringer Verlag
Pages71-82
Number of pages12
DOIs
StatePublished - 2016
Externally publishedYes

Publication series

NameLecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume10040
ISSN (Print)0302-9743
ISSN (Electronic)1611-3349

Keywords

  • Attack graph
  • Penetration testing
  • Petri net
  • Vulnerability modeling
  • Vulnerability verification

Fingerprint

Dive into the research topics of 'Automated vulnerability modeling and verification for penetration testing using petri nets'. Together they form a unique fingerprint.

Cite this