E‐NASim: A reinforcement‐learning‐based cyberattack simulation framework with pre‐/post‐state modeling based on MITRE ATT&CK

The increasing prevalence of advanced persistent threats and automated cyberattacks highlights the need for proactive cybersecurity strategies. Reinforcement‐learning‐based autonomous penetration testing has shown promise; however, many existing simulation environments rely on abstract, probability‐driven attack models, resulting in limited reproducibility and gaps relative to real‐world conditions. This paper presents E‐NASim as a reinforcement‐learning‐based cyberattack simulation framework that explicitly models attack feasibility and system evolution using pre‐/post‐attack state (PPS) transitions derived from MITRE ATT&CK subtechniques. In E‐NASim, attack execution conditions and state transitions are deterministically governed by PPS definitions, whereas reinforcement learning is used to learn effective multistage attack sequencing under fixed constraints. Experimental results demonstrate that E‐NASim enables agents to learn coherent and executable multistage attack strategies in complex network environments, providing a practical foundation for automated penetration testing and security evaluation.