Autonomous Cognitive Architecture for Offensive Cyberspace Operations
A Recursive Large Language Model Framework for Automated Vulnerability Assessment and Penetration Testing
Final Year Engineering Project
Slide 1
Literature Review
Evolution of Automated Penetration Testing
Generation 1: Scripted Automation
- Tools: Metasploit Pro, Core Impact
- Deterministic execution
- Limited adaptability
Generation 2: ML Classifiers
- Supervised learning for traffic analysis
- Defensive focus (IDS/IPS)
- Lacks generative capability
Generation 3: Generative AI & Cognitive Agents (Current)
Key Innovation: LLMs as reasoning cores enable generalization and contextual understanding. Systems can now adapt to unseen scenarios and generate custom exploitation code.
Seminal Research Frameworks
PentestGPT (Deng et al., 2023)
Contribution: Introduced modular design separating reasoning from code generation
- Reasoning Module: High-level strategy and decision-making
- Generation Module: Low-level command synthesis
- Parsing Module: Output interpretation
Limitation: Required human-in-the-loop for data transfer
PentestAgent (Shen et al., 2024)
Innovation: Multi-Agent System (MAS) with specialized agents
- Recon Agent, Web Assessment Agent, Exploitation Agent
- Introduced "Shadow Graph" for inter-agent communication
- Enables collaborative intelligence
AutoPentest (Henke et al., 2025)
Focus: Attack tree traversal and cost-effectiveness
- Decision-tree approach for systematic testing
- Cost analysis: $96 vs. thousands for human testers
PenHeal (Huang & Zhu, 2024)
Focus: Automated remediation phase
- Counterfactual prompting for root cause analysis
- Generates actionable fix recommendations
Slide 2
Theoretical Background
1. OODA Loop as Cognitive Framework
OBSERVE → ORIENT → DECIDE → ACT
↓
Feedback Loop (Recursive)
| Phase |
Description |
Implementation |
| Observe |
Gather environmental data |
Execute scanners (Nmap, curl) |
| Orient |
Analyze against knowledge base |
LLM + RAG pattern matching |
| Decide |
Select optimal action |
Priority algorithm: Impact × Probability / Cost |
| Act |
Execute command |
Sandboxed shell execution |
2. LLMs as Probabilistic Reasoning Engines
Chain-of-Thought (CoT) Prompting
Forces model to articulate reasoning before action:
Thought: Target runs Jenkins → Plan: Try default creds → Command: curl -u admin:admin
Benefit: Reduces hallucinations by 40-60%
In-Context Learning
- System prompt defines persona
- Few-shot examples guide behavior
- Generalizes to novel targets
Key Capabilities
- Natural language understanding
- Code generation (Python, Bash)
- Pattern recognition in outputs
3. Retrieval-Augmented Generation (RAG)
Problem: Knowledge Cutoff
LLMs lack information about vulnerabilities discovered post-training
Solution: Dynamic Knowledge Injection
- Detect software version (e.g., "Apache Struts 2.5.12")
- Query vector database for CVEs
- Inject relevant documents into LLM context
- Generate exploitation strategy
Slide 5
Proposed Methodology
Stage 1: Autonomous Reconnaissance
Input: Target scope (IP range / Domain)
Step 1: Initial Scope Analysis
→ If Domain: DNS enumeration
→ If IP: Port scanning
Step 2: Iterative Scanning
→ Fast scan: nmap -F -T4 (Top 100 ports)
→ Analyze results: "Port 80, 443 open"
→ Deep scan: nmap -sV -sC -p 80,443
Output: Service version details → Shadow Graph update
Stage 2: Recursive Vulnerability Analysis
- Hypothesis Generation: LLM queries Shadow Graph for untested services
- RAG Retrieval: Query CVE database for known vulnerabilities
- Exploit Planning: Generate custom test payload
- Execution: Run exploit via Execution Engine
- Verification: Parse output for success indicators
- Graph Update: Store confirmed vulnerability with proof
