Research Article

ShotFlex: A reinforcement learning-based cyber attack path generation method for cybersecurity evaluation

¹ Department of New Networks, Peng Cheng Laboratory, Shenzhen, 518000, China
² Department of Computer Science and Engineering, Southern University of Science and Technology, Shenzhen, 518055, China

^* Corresponding authors (email: This email address is being protected from spambots. You need JavaScript enabled to view it. (Yan Jia); email: This email address is being protected from spambots. You need JavaScript enabled to view it. (Yangyang Mei))

Received: 28 February 2025
Revised: 9 May 2025
Accepted: 8 July 2025

Abstract

Penetration testing is an important method for discovering hidden vulnerabilities and attack paths in network systems, which is of great significance for evaluating network security. However, traditional penetration testing methods can only be carried out by security analysts, and the results are unstable, requiring extra time and money. Automated penetration testing can effectively reduce reliance on manual efforts. Automated attack planning, as one of the most critical components, has garnered widespread attention from researchers. Although previous studies have explored a variety of methods to mine attack paths, most of them require prior knowledge of the network topology, which contradicts reality and thus lacks application value. To automatically find the best potential attack path in complex and unknown networks from the hacker’s perspective, this paper proposes ShotFlex: a reinforcement learning-based method that uses a quantifiable method to evaluate host and obtain rewards, which guides the agent to choose the best response action to discover attack paths from the intruder’s perspective. ShotFlex also introduces a pruning strategy based on prior knowledge to accelerate path generation. Experimental results reveal that ShotFlex can combine current information to provide an effective decision and significantly improve the efficiency of penetration testing.