![](bg7.png)
Figure 7: Properties update in ontology.
7 CONCLUSION
In this paper, we proposed an ontology-based auto-
mated penetration testing approach. According to
our proposed penetration testing attack taxonomy, we
built an ontology by Protege. To help make decisions
and produce new knowledge, we make use of SWRL
rules to create a penetration testing knowledge base
as well as to achieve reasoning functions. Finally, we
use agent-based(BDI) framework and Owlready2 to
achieve the process of automated penetration testing.
To validate our approach, we used BDIPython library
to implement an attack scenario in a virtual environ-
ment. The ontology and BDI agent are extendable,
while we are going to find ways to extend it automat-
ically in the future.
REFERENCES
Bodenreider, O. (2004). The unified medical language sys-
tem (umls): integrating biomedical terminology. Nu-
cleic acids research, 32(suppl 1):D267–D270.
Bordini, R. H., H
¨
ubner, J. F., and Wooldridge, M. (2007).
Programming multi-agent systems in AgentSpeak us-
ing Jason, volume 8. John Wiley & Sons.
Bremner, P., Dennis, L. A., Fisher, M., and Winfield, A. F.
(2019). On proactive, transparent, and verifiable eth-
ical reasoning for robots. Proceedings of the IEEE,
107(3):541–561.
Broad, J. and Bindner, A. (2013). Hacking with Kali: prac-
tical penetration testing techniques. Newnes.
Chu, G. and Lisitsa, A. (2018). Poster: Agent-based (bdi)
modeling for automation of penetration testing. In
2018 16th Annual Conference on Privacy, Security
and Trust (PST), pages 1–2. IEEE.
Gao, J.-b., Zhang, B.-w., Chen, X.-h., and Luo, Z. (2013).
Ontology-based model of network and computer at-
tacks for security assessment. Journal of Shanghai
Jiaotong University (Science), 18(5):554–562.
Guarino, N. (1995). Formal ontology, conceptual analysis
and knowledge representation. International journal
of human-computer studies, 43(5-6):625–640.
Herzog, A., Shahmehri, N., and Duma, C. (2007). An ontol-
ogy of information security. International Journal of
Information Security and Privacy (IJISP), 1(4):1–23.
Horrocks, I., Patel-Schneider, P. F., Boley, H., Tabet, S.,
Grosof, B., Dean, M., et al. (2004). Swrl: A semantic
web rule language combining owl and ruleml. W3C
Member submission, 21(79):1–31.
Kennedy, D., O’gorman, J., Kearns, D., and Aharoni, M.
(2011). Metasploit: the penetration tester’s guide. No
Starch Press.
Knight, K., Chander, I., Haines, M., Hatzivassiloglou, V.,
Hovy, E., Iida, M., Luk, S. K., Whitney, R., and Ya-
mada, K. (1995). Filling knowledge gaps in a broad-
coverage machine translation system. arXiv preprint
cmp-lg/9506009.
Kotenko, I. and Doynikova, E. (2014). Security assess-
ment of computer networks based on attack graphs
and security events. In Information and Communica-
tion Technology-EurAsia Conference, pages 462–471.
Springer.
Lamy, J.-B. (2017). Owlready: Ontology-oriented pro-
gramming in python with automatic classification and
high level constructs for biomedical ontologies. Arti-
ficial intelligence in medicine, 80:11–28.
Lenat, D. B. and Guha, R. V. (1989). Building large
knowledge-based systems; representation and infer-
ence in the Cyc project. Addison-Wesley Longman
Publishing Co., Inc.
Miller, G. A. (1995). Wordnet: a lexical database for en-
glish. Communications of the ACM, 38(11):39–41.
Moga, H., Boscoianu, M., Ungureanu, D., Lile, R., and
Erginoz, N. (2015). Massive cyber-attacks patterns
implemented with bdi agents. In Applied Mechan-
ics and Materials, volume 811, pages 383–389. Trans
Tech Publ.
Musen, M. A. et al. (2015). The prot
´
eg
´
e project: a look
back and a look forward. AI matters, 1(4):4.
Nickerson, C., Kennedy, D., Smith, E., Rabie, A., Friedli,
S., Searle, J., Knight, B., Gates, C., and McCray, J.
(2014). Penetration testing execution standard.
Ning, Z., Xin-yuan, C., Yong-fu, Z., and Si-yuan, X.
(2008). Design and application of penetration at-
tack tree model oriented to attack resistance test. In
2008 International Conference on Computer Science
and Software Engineering, volume 3, pages 622–626.
IEEE.
Obes, J. L., Sarraute, C., and Richarte, G. (2013). At-
tack planning in the real world. arXiv preprint
arXiv:1306.4044.
Pandya, D. and Patel, N. (2016). Owasp top 10 vulnerability
analyses in government websites. International Jour-
nal of Enterprise Computing and Business Systems,
6(1).
Pinkston, J., Undercoffer, J., Joshi, A., and Finin, T. (2004).
A target-centric ontology for intrusion detection. In
In proceeding of the IJCAI-03 Workshop on Ontolo-
gies and Distributed Systems. Acapulco, August 9 th.
Citeseer.
Ontology-based Automation of Penetration Testing
719