Optimization of the penetration testing process in automated process control systems using machine learning algorithms

The process of widespread implementation of automated information management systems in industry, energy and transport is studied in the paper. It is noted that an increase in their complexity inevitably leads to the emergence of various kinds of vulnerabilities in these systems, the presence of which allows attackers to penetrate automated control systems, take control of them, and also disrupt the normal operation of the technological processes they control. It is emphasized that over the past decade, successful cyber attacks have been recorded in the energy sector, including nuclear, in maritime shipping, in port transshipment complexes, as well as in other systems. A preventive approach to ensuring the security of automated control systems is to identify and exploit existing vulnerabilities by simulating possible cyber attacks. It is noted that automation of such a rather labor-intensive process as “penetration testing” allows reducing time, financial costs and other resources. The main methods for identifying vulnerabilities, including the use of artificial intelligence, have been studied. The presented approach to optimizing the penetration testing process in automated process control systems uses machine learning algorithms. Preference is given to machine learning with reinforcement, which is based on the Deep Q-learning algorithm. The integration of network scanning methods, building an attack graph and training neural networks to effectively identify vulnerabilities and risks in network infrastructures is proposed in the paper. To build an attack graph, the MITER ATT&CK knowledge base using the GBVA Framework is utilized, and the Deep Q-learning algorithm is used to select optimal actions during testing.