# A Survey on Penetration Path Planning in Automated Penetration Testing
## 1 Introduction  
With the rapid advancement of artificial intelligence, big data, and other network technologies, the frequency and severity of cybersecurity incidents are escalating globally. These incidents pose significant threats to personal privacy, corporate assets, and even national security. According to Skybox's \"2023 Vulnerability and Threat Trends Report\" [1], the National Vulnerability Database recorded 25,096 new vulnerabilities in 2022, setting a historical record and marking a 25% increase compared to 2021. The cumulative number of vulnerabilities is nearing 200,000. This surge in vulnerabilities significantly expands the attack surface available to malicious actors, exacerbating the cybersecurity landscape. Simultaneously, the number of state-sponsored cyber operations and Advanced Persistent Threats attacks is on the rise, further increasing the complexity and stealth of cyberattacks. These threats not only employ sophisticated technical methods but also often exhibit high levels of organization and precise targeting, presenting unprecedented challenges to traditional cybersecurity defense strategies. Traditional network defense strategies have primarily focused on identifying and intercepting external attacks to prevent potential threats from entering the intranet [2]. However, as attack methods have evolved, the limitations of this passive defense approach have become increasingly apparent. Specifically, passive defense mechanisms tend to be reactive rather than proactive, addressing threats only after they have been detected, which can leave networks vulnerable to sophisticated and evolving attacks [3, 4]. In this context, penetration testing (PT) is employed as a proactive method for assessing the security of network systems [5]. It identifies potential vulnerabilities and security risks within these systems by simulating hacker strategies and tactics, allowing for targeted remediation to strengthen network defenses [6]. Additionally, PT can be customized based on the specific needs of an organization, with a focus on penetrating high-value targets. Currently, PT primarily depends on human experts with specialized training, relying heavily on their expertise and experience. However, the increasing demand for PT, combined with limited resources and a shortage of qualified professionals, poses significant challenges to its efficiency and widespread adoption [7]. To address these challenges, automated PT technologies have become a subject of research in both academic and industrial contexts. In the early days of automated PT, tools such as Nmap and Metasploit have made significant advancements in partially automating the PT process and improving efficiency [8]. However, these tools still require experienced experts to analyze and interpret the results, as they lack the ability to make intelligent decisions and fully automate the entire process. To achieve full automation of the PT process, penetration path planning, also known as attack path planning, has become a critical component [9]. Its task is to determine the optimal route from the attack starting point to the target, aiming to maximize vulnerability discovery rates and increase the likelihood of successful attacks. Initially, penetration path planning methods focused on static analysis of the network environment to identify penetration paths [10; 11]. These methods typically model the environment using attack graphs or planning domain models and automate PT through search or planning algorithms. With advancements in artificial intelligence, modern penetration path planning techniques have evolved to learn from simulations environments using Reinforcement Learning (RL) [12] or to use Large Language Models (LLMs) [13] to plan potential penetration paths. This review paper aims to systematically review the evolution of penetration path planning technologies in automated PT, as well as to classify and explain the relevant advancements. This paper is organized as follows.