MEGA-PT: A Meta-Game Framework for Agile Penetration Testing

TL;DR

MEGA-PT tackles the limitations of manual and poorly scalable automated penetration testing by formulating a meta-security game that couples node-level micro tactic games with a network-wide macro strategy process. It models the target as $G=\langle \mathcal{V}, \mathcal{E} \rangle$ with an initial foothold, and defines MTGs $\{\Gamma^v\}$ and a MSP $\Lambda^g$ to capture local and global dynamics, linking tactics to lateral movement through an MDP framework. The framework supports multiple security schemes, including optimal local penetration plans, purple-teaming defense plans, and equilibrium-based risk assessment, with theoretical guarantees such as Kuhn's theorem-based equivalence between mixed and operational strategies and Subgame Perfect Nash Equilibria. Computation proceeds via a purple-teaming meta-penetration algorithm that iteratively computes local MTG plans, evaluates the macro value function $V^{\pi^g}$, and updates the meta-penetration playbook, enabling scalable, parallelizable testing. Empirically, case studies show that purple-teaming mitigates network risk, adapts to local changes, and scales to larger networks more efficiently than RL-based approaches, underscoring MEGA-PT's practical impact for automated, TTP-aligned cybersecurity testing.

Abstract

Penetration testing is an essential means of proactive defense in the face of escalating cybersecurity incidents. Traditional manual penetration testing methods are time-consuming, resource-intensive, and prone to human errors. Current trends in automated penetration testing are also impractical, facing significant challenges such as the curse of dimensionality, scalability issues, and lack of adaptability to network changes. To address these issues, we propose MEGA-PT, a meta-game penetration testing framework, featuring micro tactic games for node-level local interactions and a macro strategy process for network-wide attack chains. The micro- and macro-level modeling enables distributed, adaptive, collaborative, and fast penetration testing. MEGA-PT offers agile solutions for various security schemes, including optimal local penetration plans, purple teaming solutions, and risk assessment, providing fundamental principles to guide future automated penetration testing. Our experiments demonstrate the effectiveness and agility of our model by providing improved defense strategies and adaptability to changes at both local and network levels.

Figures (10)

• Figure 1: Attack plan and tactics, techniques, and procedures (TTPs). Depending on the level of detail, each attack plan can be elaborated by a sequence of tactics (from left to right), where each tactic is composed of a sequence of techniques, and each technique can be described by a sequence of procedures.
• Figure 2: Illustration of the networked system topology. The system contains $5$ nodes (web server, application server, $2$ user devices, and critical asset). The penetration testing starts from the web server, which is open to the external network.
• Figure 3: Micro Tactic Game at the web server. The attacker needs to discover the host and services on the node, requesting privilege escalation to collect the credentials leading to other nodes. The defender could grant or deny the attacker's request depending on the defense strategy. The players' sequence of actions would lead to different expected tactic outcomes.
• Figure 4: Relationship between Macro Strategic Process and Micro Tactic Games. The local penetration plans in the micro games affect the global attack strategy, while the policy evaluation at the macro process helps provide the utilities in the micro games.
• Figure 5: Node values under different conditions. The $x$-axis is the number of iterations and $y$-axis is the value of the node for the attacker. We consider both fixed defense and purple teaming defense against three types of attackers ($c_a=\{0.2,0.5,0.8\}$).

Theorems & Definitions (18)

• definition thmcounterdefinition: Micro Tactic Game (MTG)
• definition thmcounterdefinition: Knowledge Set
• definition thmcounterdefinition: Pure Penetration (Defense) Plan
• definition thmcounterdefinition: Mixed Penetration (Defense) Plan
• definition thmcounterdefinition: Operational Search Plan
• theorem thmcountertheorem: Planning Equivalence
• proof
• definition thmcounterdefinition: Optimal Local Penetration Plan
• remark thmcounterremark: Optimal v.s. Practical
• definition thmcounterdefinition: Tactic Outcome Probability