Enabling Multi-Agent Penetration Testing Environments for Software Vulnerability Detection

Abstract

In light of the ongoing challenge posed by unknown vulnerabilities in software solutions, the prompt identification and rectification of these weaknesses are of vital importance. Traditional penetration testing, although thorough, typically demands substantial human resources and time commitments. To contend with this issue, we propose an innovative penetration testing framework that incorporates natural language processing, utilizing large language model (LLM) driven multi-agent systems to automate and expedite vulnerability detection. By integrating insights from established exploit signatures and AI-driven fuzzing techniques, our framework, LLMAZD, preemptively examines target software within a controlled setting, effectively identifying both zero-day and one-day exploits, as well as system vulnerabilities, in a cost-effective manner. The framework demonstrates versatility in detecting multiple vulnerability classes, including SQL injection, Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), file upload vulnerabilities, and other different types, all while maintaining efficiency and cost-effectiveness throughout the testing process. Extensive evaluations on more than 20 CVE test cases reveal that the framework substantially enhances detection capabilities, reduces the overall burden of testing, and offers a practical pathway towards more secure software ecosystems.