# A Survey on Penetration Path Planning in Automated Penetration Testing
## 7 Conclusions and Future Directions  
In conclusion, this work provides a comprehensive overview of current research and future directions in penetration path planning within automated PT, focusing on four key aspects: the framework of the penetration path planning problem, the planning models, the planning methods, and the simulation environments. First, this paper examines the framework of automated PT and thoroughly reviews the penetration path planning problem. Next, it systematically categorizes the planning models used in penetration path planning, including graph security models, planning domain models, and sequential decision models. This is followed by a detailed discussion of research advancements in penetration path planning, particularly in the use of intelligent planning, RL, and LLMs. Finally, the simulation environments for training penetration path planning are summarized. As a key component of automated PT, penetration path planning is increasingly demonstrating its potential and value in real-world applications. This study addresses the four posed RQs as follows:  
1. **RQ1: How can the penetration path planning problem be modeled? ** To answer RQ1, this paper introduces three key modeling methods in Section 4. graphical security models, like attack graphs, are ideal for small-scale networks but struggle with complexity as the network grows. Planning domain models simplify the environment using structured frameworks such as PDDL, aiding in strategic planning but may not fully capture dynamic real-world threats. MDPs and POMDPs offer a more flexible and realistic approach by modeling sequential decision-making, making them particularly effective in large-scale and complex scenarios. 2. **RQ2: What are the current methodologies for solving the penetration path planning problem, and what are the recent research developments in this area? ** Currently, there are three main approaches to solving the penetration path planning problem: intelligent planning, RL, and LLMs. Section 5 provides a detailed overview of the latest developments in these methods. Intelligent planning leverages precise environmental models and employs search or optimization algorithms to identify the optimal penetration path. RL trains agents in simulated environments to plan penetration paths based on real-time feedback. LLMs, with their powerful language comprehension and embedded expert knowledge, have shown significant potential in planning and exploration in real-world scenarios. 3. **RQ3: What simulation environments are available for training penetration path planning? ** To answer RQ3, Section 6 introduces the simulation environments available for training penetration path planning. Currently, simulation environments are mainly divided into two categories: those developed based on Gym and others that are independently developed with higher customization and flexibility. Gym-based simulation environments, such as CyberBattleSim and CybORG, typically rely on standard RL libraries and algorithms, making them suitable for rapid development and testing. On the other hand, independently developed environments like CYST offer more complex behavior control and seamless integration with real-world systems, focusing on enhancing realism and practical applicability in simulations. Future Directions  
Moreover, there are several areas or opportunities in which current penetration path planning methods could be further improved:  
Existing planning models primarily focus on the perspective of penetration testers, making the integration of defenders into penetration path planning an important future research direction. Investigating the use of defensive agents to simulate defenders' strategies, along with applying game theory principles to analyze the interactions between attackers and defenders, are research directions that warrant in-depth exploration.