Orchestrace AI agentů pro penetracni testovani

Abstract

This master's thesis deals with the design, implementation, and experimental verification of an orchestrator for autonomous penetration testing based on multi-agent systems. The primary objective is to overcome the limitations of traditional manual testing and monolithic large language models, which are prone to hallucinations and context loss. The proposed architecture utilizes specialized agents for network reconnaissance, vulnerability analysis, validation, exploitation, and reporting. The system is controlled by a state machine built on the LangGraph framework, coordinating asynchronous event processing and effectively sharing context across agents via a centralized knowledge base. The introduction of a historical experience module (Experience Store) reduced the need for repetitive search of known states and resulted in runtime reduction of around 44%. Experiment verified functionality and stability of the designed prototype in Metasploitable 2 laboratory environment. The system autonomously completed 31 iterations in 6 minutes and 18 seconds, identifying 74 potential vulnerabilities based on CVE database mapping and executing 6 successful compromises at a total cost of approximately $0.061. The thesis also analyzes the potential integration of quantum algorithms for attack path optimization; however, their implementation was omitted due to the high error rates of current NISQ hardware.