Automated attack graph creation aids efficient vulnerability detection
Automating Attack Graph Construction for Agentic Pentesting. Towards Neuro-Symbolic Vulnerability Hunting
Cryptography and SecurityArtificial Intelligence
Summary
Finding all the weak spots hackers might use to break into a website is complicated. The authors created a system that turns security scanner reports into clear, step-by-step paths of how an attacker might succeed. This system uses a mix of computer logic tools and artificial intelligence to build these paths automatically. Their tests on web security challenges showed it can find over half of the known vulnerabilities efficiently, helping security teams better understand potential attacks.
What this means in practice
- •For cybersecurity teams: Generate readable attack paths from automated scan data to assist in prioritizing vulnerabilities.
- •For security automation engineers: Integrate symbolic attack reasoning into automated pentesting workflows for clearer vulnerability analysis.
Authors
Oliver Stevanovic, Jasmin Wachter
Abstract
Logic attack graphs grounded in scanner output provide explicit and auditable attack path reasoning LLM-based agents lack. Integrating symbolic frameworks such as MulVAL to contemporary security workflows or agentic pipelines, however, requires translating scanner evidence to initial facts, and creating domain-specific rules. We present a semi-automated pipeline that addresses this interoperability problem and depict its feasibility in a web-security case study. Our pipeline parses findings from Trivy, Semgrep, and Nmap into MulVAL predicates and uses an LLM-assisted process to construct domain-specific Datalog rules linking scanner-detectable evidence to attack techniques. MulVAL/XSB then performs symbolic inference to generate structured attack paths. We evaluate the attack-graph construction infrastructure on 54 web Capture-the-Flag tasks from CyBench within an agentic pipeline (Hybrid Reasoner); we do not evaluate the performance of the downstream agent. Every task produced at least one goal-reaching graph, and we achieve mean ground-truth vulnerability coverage of 53.7%, with 51.9% achieving full coverage; mean noise-path rate was 83.9%. With median end-to-end time of 24.9 s (MulVAL reasoning: 2.7 s) the pipeline is feasible and runtime-practical for agentic workflows, but predicate coverage, rule coverage, and path precision remain limiting factors. Next steps include semantic rule validation and agent-level comparison for graph-guided pentesting.