US 11,677,776 B2
Dynamic attack path selection during penetration testing
Paul Deardorff, San Francisco, CA (US); and Dustin Myers, Alexandria, VA (US)
Assigned to Rapid7, Inc., Boston, MA (US)
Filed by Rapid7, Inc., Boston, MA (US)
Filed on Jul. 6, 2022, as Appl. No. 17/858,148.
Application 17/858,148 is a continuation of application No. 16/178,705, filed on Nov. 2, 2018, granted, now 11,418,528.
Prior Publication US 2022/0360603 A1, Nov. 10, 2022
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1433 (2013.01) [H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computer-implemented method, comprising:
initiating a penetration test to simulate an attack on a computer network;
interrupting the penetration test at a particular hop to select a next action path of the penetration test, comprising:
identifying a plurality of available action paths to a plurality of next hops achievable from the particular hop,
calculating a penetration parameter for each of the available action paths, the calculation comprising:
determining a positive reward associated with a next hop associated with the available action path,
negatively adjusting the positive reward with a detection parameter associated with the available action path, and
negatively adjusting the positive reward with a time parameter associated with the available action path, and
selecting one of the available action paths as the next action path based on the penetration parameters of the available action paths; and
executing the next action path to continue the penetration test.