{"id":{"repo_id":"mit","oai_identifier":"oai:dspace.mit.edu:1721.1/159083"},"canonical_url":"https://search.dev.ndltd.org/etd/mit/oai:dspace.mit.edu:1721.1/159083","repository":{"repo_id":"mit","name":"MIT","base_url":"https://dspace.mit.edu/oai/request"},"display":{"title":"ALFA-Chains: An Artificial Intelligence Approach to Exploit Chain Discovery in Networks","abstract":"Exploit chains play a crucial role in advanced persistent threats (APTs) and other malicious cyber campaigns. Sophisticated attackers can navigate across a network, escalate their privileges, and compromise valuable targets by executing the right exploits in the right order. However, finding these exploits chains is a challenging task requiring a broad knowledge of the vulnerabilities present in computer systems and the exploits that take advantage of them. Networks can be complex, with many hosts and intricate software stacks. Moreover, the range of known exploits and vulnerabilities is constantly growing, complicating the process of determining how they can be linked. This thesis introduces a solution, ALFA-Chains, that automates the discovery of exploit chains by leveraging classical AI planning, Large Language Models (LLMs), and existing exploit/vulnerability databases. ALFA-Chains describes networks and exploits using the Planning Domain Description Language (PDDL), a formal language to represent planning problems. This allows us to use optimized off-the-shelf planners that have been developed by the AI planning community over many years. Our system takes natural language descriptions of exploits and classifies them into categories based on their preconditions and effects. From this intermediary representation, we can programmatically generate PDDL that captures the requirements needed to run the exploit and the access gained by the attacker. Due to this automated approach, ALFA-Chains is able to consider a vast set of exploits when determining if a network is susceptible to exploit chaining. We show how ALFA-Chains can process 1,880 Metasploit exploits and their corresponding 2,002 CVEs to detect exploit chains in a variety of realistic network configurations. We proceed to discuss potential applications of ALFA-Chains, including automated penetration testing and vulnerability prioritization.","abstract_html":"Exploit chains play a crucial role in advanced persistent threats (APTs) and other malicious cyber campaigns. Sophisticated attackers can navigate across a network, escalate their privileges, and compromise valuable targets by executing the right exploits in the right order. However, finding these exploits chains is a challenging task requiring a broad knowledge of the vulnerabilities present in computer systems and the exploits that take advantage of them. Networks can be complex, with many hosts and intricate software stacks. Moreover, the range of known exploits and vulnerabilities is constantly growing, complicating the process of determining how they can be linked. This thesis introduces a solution, ALFA-Chains, that automates the discovery of exploit chains by leveraging classical AI planning, Large Language Models (LLMs), and existing exploit/vulnerability databases. ALFA-Chains describes networks and exploits using the Planning Domain Description Language (PDDL), a formal language to represent planning problems. This allows us to use optimized off-the-shelf planners that have been developed by the AI planning community over many years. Our system takes natural language descriptions of exploits and classifies them into categories based on their preconditions and effects. From this intermediary representation, we can programmatically generate PDDL that captures the requirements needed to run the exploit and the access gained by the attacker. Due to this automated approach, ALFA-Chains is able to consider a vast set of exploits when determining if a network is susceptible to exploit chaining. We show how ALFA-Chains can process 1,880 Metasploit exploits and their corresponding 2,002 CVEs to detect exploit chains in a variety of realistic network configurations. We proceed to discuss potential applications of ALFA-Chains, including automated penetration testing and vulnerability prioritization.","abstract_has_math":false,"creators":["Tulla Lizardi, Miguel A."],"institution":"Massachusetts Institute of Technology","degree_name":"Master","degree_level":null,"degree_discipline":null,"degree_department":"Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science","school":null,"contributors":[],"advisors":["O’Reilly, Una-May","Hemberg, Erik"],"committee_chairs":[],"committee_members":[],"year":2025,"date_issued":"2025-02","date_published":"2025-02","updated_at":"2026-07-22T22:20:48Z","subjects":[],"languages":[],"rights":["In Copyright - Educational Use Permitted","Copyright retained by author(s)"],"rights_urls":["https://rightsstatements.org/page/InC-EDU/1.0/"],"identifier_entries":[]},"links":{"outbound_url":"https://hdl.handle.net/1721.1/159083","outbound_label":"Handle","outbound_source":"dc:identifier.uri"},"metadata_groups":[{"id":"people","label":"People","entries":[{"key":"dc:contributor.advisor","label":"Advisor","values":["O’Reilly, Una-May","Hemberg, Erik"]},{"key":"dc:contributor.department","label":"Department","values":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science"]},{"key":"dc:creator","label":"Author","values":["Tulla Lizardi, Miguel A."]}]},{"id":"academic_context","label":"Academic Context","entries":[{"key":"dc:date.accessioned","label":"Dc Date Accessioned","values":["2025-04-14T14:04:26Z"]},{"key":"dc:date.available","label":"Dc Date Available","values":["2025-04-14T14:04:26Z"]},{"key":"dc:date.issued","label":"Date","values":["2025-02"]},{"key":"dc:publisher","label":"Institution","values":["Massachusetts Institute of Technology"]},{"key":"dc:type","label":"Dc Type","values":["Thesis"]},{"key":"thesis:degree_name","label":"Degree Name","values":["Master","Master of Engineering in Electrical Engineering and Computer Science"]}]},{"id":"language_rights","label":"Language and Rights","entries":[{"key":"dc:rights","label":"Dc Rights","values":["In Copyright - Educational Use Permitted","Copyright retained by author(s)"]},{"key":"dc:rights.uri","label":"Rights URI","values":["https://rightsstatements.org/page/InC-EDU/1.0/"]}]},{"id":"identifiers","label":"Identifiers","entries":[{"key":"dc:identifier.uri","label":"Identifier URI","values":["https://hdl.handle.net/1721.1/159083"]}]},{"id":"additional","label":"Additional Metadata","entries":[{"key":"dc:description.abstract","label":"Abstract","values":["Exploit chains play a crucial role in advanced persistent threats (APTs) and other malicious cyber campaigns. Sophisticated attackers can navigate across a network, escalate their privileges, and compromise valuable targets by executing the right exploits in the right order. However, finding these exploits chains is a challenging task requiring a broad knowledge of the vulnerabilities present in computer systems and the exploits that take advantage of them. Networks can be complex, with many hosts and intricate software stacks. Moreover, the range of known exploits and vulnerabilities is constantly growing, complicating the process of determining how they can be linked. This thesis introduces a solution, ALFA-Chains, that automates the discovery of exploit chains by leveraging classical AI planning, Large Language Models (LLMs), and existing exploit/vulnerability databases. ALFA-Chains describes networks and exploits using the Planning Domain Description Language (PDDL), a formal language to represent planning problems. This allows us to use optimized off-the-shelf planners that have been developed by the AI planning community over many years. Our system takes natural language descriptions of exploits and classifies them into categories based on their preconditions and effects. From this intermediary representation, we can programmatically generate PDDL that captures the requirements needed to run the exploit and the access gained by the attacker. Due to this automated approach, ALFA-Chains is able to consider a vast set of exploits when determining if a network is susceptible to exploit chaining. We show how ALFA-Chains can process 1,880 Metasploit exploits and their corresponding 2,002 CVEs to detect exploit chains in a variety of realistic network configurations. We proceed to discuss potential applications of ALFA-Chains, including automated penetration testing and vulnerability prioritization."]},{"key":"dc:description.degree","label":"Dc Description Degree","values":["M.Eng."]},{"key":"dc:title","label":"Title","values":["ALFA-Chains: An Artificial Intelligence Approach to Exploit Chain Discovery in Networks"]}]}],"canonical_facts":{"dc:contributor.advisor":["O’Reilly, Una-May","Hemberg, Erik"],"dc:contributor.department":["Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science"],"dc:creator":["Tulla Lizardi, Miguel A."],"dc:date.accessioned":["2025-04-14T14:04:26Z"],"dc:date.available":["2025-04-14T14:04:26Z"],"dc:date.issued":["2025-02"],"dc:description.abstract":["Exploit chains play a crucial role in advanced persistent threats (APTs) and other malicious cyber campaigns. Sophisticated attackers can navigate across a network, escalate their privileges, and compromise valuable targets by executing the right exploits in the right order. However, finding these exploits chains is a challenging task requiring a broad knowledge of the vulnerabilities present in computer systems and the exploits that take advantage of them. Networks can be complex, with many hosts and intricate software stacks. Moreover, the range of known exploits and vulnerabilities is constantly growing, complicating the process of determining how they can be linked. This thesis introduces a solution, ALFA-Chains, that automates the discovery of exploit chains by leveraging classical AI planning, Large Language Models (LLMs), and existing exploit/vulnerability databases. ALFA-Chains describes networks and exploits using the Planning Domain Description Language (PDDL), a formal language to represent planning problems. This allows us to use optimized off-the-shelf planners that have been developed by the AI planning community over many years. Our system takes natural language descriptions of exploits and classifies them into categories based on their preconditions and effects. From this intermediary representation, we can programmatically generate PDDL that captures the requirements needed to run the exploit and the access gained by the attacker. Due to this automated approach, ALFA-Chains is able to consider a vast set of exploits when determining if a network is susceptible to exploit chaining. We show how ALFA-Chains can process 1,880 Metasploit exploits and their corresponding 2,002 CVEs to detect exploit chains in a variety of realistic network configurations. We proceed to discuss potential applications of ALFA-Chains, including automated penetration testing and vulnerability prioritization."],"dc:description.degree":["M.Eng."],"dc:identifier.uri":["https://hdl.handle.net/1721.1/159083"],"dc:publisher":["Massachusetts Institute of Technology"],"dc:rights":["In Copyright - Educational Use Permitted","Copyright retained by author(s)"],"dc:rights.uri":["https://rightsstatements.org/page/InC-EDU/1.0/"],"dc:title":["ALFA-Chains: An Artificial Intelligence Approach to Exploit Chain Discovery in Networks"],"dc:type":["Thesis"],"thesis:degree_name":["Master","Master of Engineering in Electrical Engineering and Computer Science"]},"updated_at":"2026-07-22T22:20:48Z"}