Prompt. Exploit. Repeat: Automating Network Security Testing with LLMs

Large Language Models (LLMs) have demonstrated remarkable capabilities in various tasks, but their potential in cybersecurity remains largely unexplored. Despite their inherent limitations, LLM-based designs have shown promising ability in planning and navigating open-world scenarios. This paper investigates the application of pre-trained LLMs as agents in network security environments, a domain traditionally dominated by reinforcement learning (RL) approaches. We introduce a novel method that leverages LLMs for sequential decision-making in cybersecurity scenarios, that is flexible and does not need retraining to adapt to new scenarios. Our study employs two distinct environments: Microsoft’s CyberBattleSim and our newly developed NetSecGame, which incorporates more realistic network conditions and a defender component. We compare the performance of LLM agents, against traditional reinforcement learning agents across various scenarios. Results show that the best LLM agents achieve success rates of 100% in undefended scenarios and up to 53.3% in the most challenging defended scenarios, outperforming conventional RL agents without requiring additional training. Furthermore, we present NetSecGame, a modular and scalable network security environment that addresses the limitations of existing platforms by providing more realistic conditions for testing attacking and defending agents. This research demonstrates the potential of LLMs in cybersecurity applications, offering a flexible and efficient alternative to traditional RL approaches in network security testing.

International Conference on Agents and Artificial Intelligence (ICAART), 15–36