Toward Intelligent Autonomous Penetration Testing: Integrating AI-Driven Web Vulnerability Discovery with Machine Learning-Based Risk Prioritization

The expanding attack surface of modern web applications, combined with a persistent shortage of skilled penetration testers, has motivated a decade of research into artificial intelligence (AI) and machine learning (ML) methods for automating security assessment. This paper surveys three converging research threads AI-driven discovery of web vulnerabilities, ML-based prioritization of discovered vulnerabilities, and reinforcement-learning (RL) and large-language-model (LLM) driven automated penetration testing and synthesizes them into a single proposed framework, AIVAPT (AI-driven Vulnerability Assessment and Automated Penetration Testing). We review deep-learning classifiers for injection-class vulnerabilities, graph- and sequence-based models for source-level vulnerability identification, and recent LLM-agent systems capable of autonomously exploiting real-world vulnerabilities. We then examine data-driven prioritization approaches that move beyond static severity scores, notably the Exploit Prediction Scoring System (EPSS), and formalize a composite Risk Prioritization Score that fuses CVSS severity, EPSS exploitability, asset criticality, and exposure. Building on this, we cast autonomous exploitation planning as a Markov Decision Process and describe a governance-gated architecture in which a human-in-the-loop authorization layer mediates all autonomous actions. Five comparison tables summarize ۳۰+ peer-reviewed and preprint systems across the three research threads, and we present the governing mathematical formulations (CVSS v۳.۱, EPSS, standard classification metrics, the Bellman/Q-learning equations, and the proposed composite score). We close with an evaluation protocol grounded in public benchmarks and datasets, and a discussion of open technical challenges and the responsible-use requirements that must govern any such system.

کلیدواژه ها:

penetration testing ، vulnerability discovery ، machine learning ، deep learning ، reinforcement learning ، large language models ، EPSS ، CVSS ، web application security ، autonomous agents