Enhanced Automated Penetration Testing Using Double Deep Q-Learning

Enhanced Automated Penetration Testing Using Double Deep Q-Learning | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article Enhanced Automated Penetration Testing Using Double Deep Q-Learning Eman M. Ahmed, Rasha H. Sakr, Mohamed F. Alrahmawy This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8888402/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract As cyberattacks grow in complexity, traditional manual penetration testing becomes increasingly time-consuming, costly, and dependent on expert knowledge. In this paper, we present an automated penetration testing framework based on Double Deep Q-Learning (DDQN) to enhance attack planning efficiency, stability, and decision-making. The framework builds realistic logical network topologies using real-world vulnerability and host data gathered from the Shodan search engine and the National Vulnerability Database. It produces attack graphs and effective attack paths using MulVAL and then subsequently transforms them into matrix representations appropriate for reinforcement learning. After comparison to the baseline Deep Q-Network (DQN), experimental results on static logical topologies demonstrate that DDQN achieves more stable learning and lower variance, with an average success rate of approximately 65% in reaching the target system. Using these results, we show how well DDQN directs ethical hackers toward effective attack tactics and illustrates the framework's potential for automated penetration testing systems and cybersecurity training. Physical sciences/Engineering Physical sciences/Mathematics and computing Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8888402","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":602345356,"identity":"6d1e1b5c-4445-45d2-ab19-172ad95bbe89","order_by":0,"name":"Eman M. Ahmed","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABQElEQVRIie2QMUvDQBTHXziIS6SbRI7iVwgEaqWSfpWEg2Y5RRAk4NCAYCfJ2kKhXyFQuPnCDS6BOh64NA5OLl0KDqJ3EaFekeImkv/wht/d7927B9CkyR+PrYuVqeJ+IffHy5vKJEW/VXK+Q2nh0QOsaHAOB+L5SSaiPV8sCmkpcpSi4tGB0yD9rhxOywtrwsgl4MGxT0vhM0lQ11LE4zbpOTAghuJJGqJ9hqIUhx18disiJpHtWork4HSwA4IYg/W18saGSonXtTLPhFaG0SxtrZXybiqeG3NkMaEU+vlKDkQrinDHVgoPDMWVFIo7dq+VK0zL2B9L4ncjRXJh+ydTj4TmxsZxtXxl13owhmnSa2dZUcmVIrPRTSVfkqC/tWbH4/Wn+CasO6N6coiMjQHsLbe6GBvacd6kSZMm/z4fiFhyKuhtquwAAAAASUVORK5CYII=","orcid":"","institution":"Mansoura University","correspondingAuthor":true,"prefix":"","firstName":"Eman","middleName":"M.","lastName":"Ahmed","suffix":""},{"id":602345357,"identity":"4e10d95b-eeec-4329-aee5-8b30895635be","order_by":1,"name":"Rasha H. Sakr","email":"","orcid":"","institution":"Mansoura University","correspondingAuthor":false,"prefix":"","firstName":"Rasha","middleName":"H.","lastName":"Sakr","suffix":""},{"id":602345358,"identity":"8251577d-a4c3-4dae-a0ea-8afa7dc88369","order_by":2,"name":"Mohamed F. Alrahmawy","email":"","orcid":"","institution":"Mansoura University","correspondingAuthor":false,"prefix":"","firstName":"Mohamed","middleName":"F.","lastName":"Alrahmawy","suffix":""}],"badges":[],"createdAt":"2026-02-15 21:08:13","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8888402/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8888402/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":105742630,"identity":"d7839a72-4911-4f20-b604-20d057a7ca4a","added_by":"auto","created_at":"2026-03-30 13:28:28","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":695258,"visible":true,"origin":"","legend":"","description":"","filename":"Researchlastupdate1122026.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8888402/v1_covered_4544ca62-4e2e-46b7-b85e-2dc2ba7363d0.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"Enhanced Automated Penetration Testing Using Double Deep Q-Learning","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":true,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"","lastPublishedDoi":"10.21203/rs.3.rs-8888402/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8888402/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eAs cyberattacks grow in complexity, traditional manual penetration testing becomes increasingly time-consuming, costly, and dependent on expert knowledge. In this paper, we present an automated penetration testing framework based on Double Deep Q-Learning (DDQN) to enhance attack planning efficiency, stability, and decision-making. The framework builds realistic logical network topologies using real-world vulnerability and host data gathered from the Shodan search engine and the National Vulnerability Database. It produces attack graphs and effective attack paths using MulVAL and then subsequently transforms them into matrix representations appropriate for reinforcement learning.\u003c/p\u003e \u003cp\u003eAfter comparison to the baseline Deep Q-Network (DQN), experimental results on static logical topologies demonstrate that DDQN achieves more stable learning and lower variance, with an average success rate of approximately 65% in reaching the target system. Using these results, we show how well DDQN directs ethical hackers toward effective attack tactics and illustrates the framework's potential for automated penetration testing systems and cybersecurity training.\u003c/p\u003e","manuscriptTitle":"Enhanced Automated Penetration Testing Using Double Deep Q-Learning","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-03-10 17:27:10","doi":"10.21203/rs.3.rs-8888402/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"eea362f4-173b-480d-95c6-4f323bd51d74","owner":[],"postedDate":"March 10th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":64103046,"name":"Physical sciences/Engineering"},{"id":64103047,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-03-30T13:26:28+00:00","versionOfRecord":[],"versionCreatedAt":"2026-03-10 17:27:10","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8888402","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8888402","identity":"rs-8888402","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}