CVE2AP: Automated Generation of PDDL-Encoded Attack Paths via Large Language Models

I. INTRODUCTION

• Rapid threat evolution makes expert-driven construction and maintenance of PDDL attack paths difficult to scale, motivating automated generation.The threat landscape changes with new vulnerabilities, attack techniques, and accumulating threat intelligence.Source: §I · p. 1
• Prior LLM-based PDDL generation leaves attack-path modeling largely unexplored, despite its additional requirements for exploitation fidelity and complete attack progression.Generated paths must satisfy syntax and solvability as well as cybersecurity-specific semantic requirements.Source: §I · p. 1
• CVE2AP generates PDDL attack paths from natural-language CVEs using structured prompting and planner-reported syntax and solvability errors for iterative refinement.The study evaluates multiple LLMs and generation configurations for quality, token consumption, and generation time.Source: §I · p. 1

A. Problem Statement

• CVE descriptions convey vulnerability characteristics, affected components, exploitation mechanisms, and impacts, but leave concrete actions and dependencies implicit.The task is to make that logic explicit as a feasible sequence connecting the vulnerability to its security impact while meeting planning and semantic requirements.Source: A. Problem Statement · p. 2

B. PDDL for Attack Path Modeling

• PDDL attack-path actions encode required conditions as preconditions and resulting states as effects, while a plan is a sequence that reaches the goal.Attack stages can include reconnaissance, weaponization, delivery, and exploitation, with impacts classified using STRIDE.Source: B. PDDL for Attack Path Modeling · p. 2
• The example path progresses from reconnaissance to weaponization and then exploitation, ending in denial of service.Its actions represent identifying an exposed target, crafting a payload, and achieving the impact.Source: B. PDDL for Attack Path Modeling · p. 2

III. METHODOLOGY

• CVE2AP accepts a natural-language CVE description and produces a PDDL-encoded attack path, with prompt construction and optional planner feedback as its two components.The approach is model-agnostic and supports LLMs with chat-based or completion-based interfaces.Source: §III · pp. 2–3

A. Model Options

• CVE2AP supports online commercial and locally hosted models, considers model scale, and selects chat or completion interaction according to the model.A common base prompt is rendered into the appropriate interaction format.Source: A. Model Options · p. 3, B. Prompt Construction · p. 3

B. Prompt Construction

• The system prompt defines the LLM’s role and task, and directs it to make conservative assumptions grounded in common security knowledge when CVE descriptions are ambiguous.The prompt asks for syntactically correct, solvable, and semantically valid attack paths.Source: B. Prompt Construction · p. 3
• The adversarial model constrains initial attacker position and privileges and limits each generated path to exploiting one CVE for one STRIDE goal.It also rules out prior access to system internals and breaking strong cryptography.Source: B. Prompt Construction · p. 3
• A five-stage reference guides paths from mandatory exposure through optional weaponization, delivery, and exploitation to mandatory impact, without requiring a rigid sequence.Not all vulnerabilities follow the same progression.Source: B. Prompt Construction · p. 3
• Few-shot configurations use zero, one, or two randomly sampled expert-authored CVE–PDDL examples, excluding the target CVE.Examples demonstrate expected output structure, action granularity, style, and detail.Source: B. Prompt Construction · pp. 4–5
• An optional output template supplies a PDDL skeleton from mandatory exposure through intermediate steps to a single STRIDE impact, without CVE-specific content.Prompt instructions also cover quality dimensions including feasibility, atomicity, and completeness.Source: B. Prompt Construction · pp. 3–5

C. Error Feedback

• The feedback loop targets syntax and solvability because planners provide actionable errors, whereas semantic evaluators primarily provide judgments or scores rather than correction guidance.The paper identifies semantic feedback as future work.Source: C. Error Feedback · p. 5
• Metric-FF checks generated PDDL syntax and plan solvability; when a check fails, planner errors and correction rules are added to the conversation for revision.The checker supports numeric fluents for vulnerability-version constraints, and the reported checking process takes milliseconds per domain.Source: C. Error Feedback · p. 5
• The loop allows up to three retries, terminates early if a check passes, and otherwise returns the output after the third retry.Revisions remain in the same conversation and require no human intervention.Source: C. Error Feedback · p. 5

• The section covers the experimental setup and results.Source: §IV · p. 5

A. Experimental Setup

• The evaluation addresses effectiveness, generation cost, and how configuration decisions affect both.Source: A. Experimental Setup · p. 5
• The dataset contains 21 CVEs, each paired with a natural-language description and expert-authored reference PDDL attack path.Source: A. Experimental Setup · p. 5
• The study selects five LLM models spanning online commercial and locally hosted options at different scales to examine trade-offs between capability and deployment cost.Source: A. Experimental Setup · p. 6
• The 12 prompt configurations combine 0-, 1-, or 2-shot prompting with error feedback and an output template, each enabled or disabled.Few-shot examples are sampled from the reference pool without using the target CVE; failed syntax or solvability checks trigger up to three feedback retries.Source: A. Experimental Setup · p. 6
• S3Eval measures syntax, solvability, and semantic quality, alongside token consumption and generation time.Semantic evaluation includes embedding similarity and LLM-as-expert judgments in intrinsic and extrinsic settings.Source: A. Experimental Setup · p. 6
• Experiments use Python 3.10 on a macOS laptop and Linux server, with a fixed random seed of 42.Online judges use temperature 0; local Qwen models run through llama.cpp with quantized weights.Source: A. Experimental Setup · p. 6

1) RQ1 (Effectiveness):

• Figure 3 reports each of six models’ mean correct rates across evaluation dimensions, averaged over 12 prompt configurations.Source: 1) RQ1 (Effectiveness) · p. 6, Figure 3 · p. 7
• Locally hosted models improve consistently with model size; Qwen3-32B reaches 39.7% syntax correctness and produces solvable paths in approximately one-third of generations.Qwen3-32B also exceeds 20% on both semantic measures.Source: 1) RQ1 (Effectiveness) · p. 6
• GPT-5.5 achieves 86.9% syntax, 78.6% solvability, 53.8% embedding-based similarity, and 93.1% LLM-as-expert correct rates.Source: 1) RQ1 (Effectiveness) · pp. 6–7, Figure 3 · p. 7

2) RQ2 (Cost):

• Median generation time rises from approximately 40 s for Qwen3-4B to 215 s for Qwen3-32B; GPT-5.5 and Deepseek-V4-Pro medians are approximately 85 s and 65 s.Figure 4 reports per-sample generation time and token cost across models; box plots show Q1, median, and Q3.Source: 2) RQ2 (Cost) · p. 7, Figure 4 · p. 8
• Qwen3-4B averages approximately 10,000 tokens per sample, Deepseek-V4-Pro about 53,000 per generation, and local Qwen3 model medians range from about 32,000 to 34,000.The paper tentatively attributes Deepseek-V4-Pro's higher consumption to additional reasoning and more verbose output.Source: 2) RQ2 (Cost) · p. 7
• GPT-5.5 produces the highest-quality paths, runs fastest among commercial models, and has the lowest token cost.The reported comparison describes this as the best quality-cost trade-off.Source: 2) RQ2 (Cost) · p. 7

3) RQ3 (Configuration Impact):

• Few-shot examples do not reliably improve quality across models, while generation time and token cost increase with exemplar count.GPT-5.5's solvability and embedding-similarity rates rise with more examples, whereas Qwen3-14B benefits stably and Qwen3-4B/8B show no consistent trend; DS-V4-Pro's 1- and 2-shot settings use more than twice the 0-shot tokens.Source: 3) RQ3 (Configuration Impact) · p. 7
• Error feedback consistently improves generation quality across evaluated models by up to +49 percentage points in syntax, +41 in solvability, and +12 in LLM-as-expert semantic evaluation.Embedding-based semantic similarity degrades slightly, while additional retries increase per-sample generation time and token consumption.Source: 3) RQ3 (Configuration Impact) · pp. 7–9
• Output templates improve solvability by approximately 1–5 percentage points but provide limited, model-dependent quality benefits while increasing generation time and token consumption.For weaker local Qwen3 models, added prompt complexity may worsen syntax and semantic results.Source: 3) RQ3 (Configuration Impact) · p. 9

A. PDDL-based Attack Path Modeling

• PDDL-based attack-path models support vulnerability analysis, adversarial-strategy generation, resilience analysis, and security-control recommendations, –.Examples include personalized vulnerability analysis, critical-infrastructure strategy generation, fault-tree integration, and attack-step generation.Source: A. PDDL-based Attack Path Modeling · p. 9
• Most prior approaches assume expert-built PDDL models, making development and maintenance labor-intensive as vulnerabilities, techniques, and environments evolve,.PDDLAssistant supports incremental model development, while device-reachability graph partitioning improves planning efficiency in large networks.Source: A. PDDL-based Attack Path Modeling · p. 9
• Bezawada et al. derived attack paths from CVE descriptions with POS tagging and handcrafted rules, but evaluated the approach only in a limited case study.The study did not systematically assess syntax correctness, solvability, and semantic correctness.Source: A. PDDL-based Attack Path Modeling · p. 9
• Automatic generation of high-quality, planner-ready PDDL attack paths remained unexplored, motivating CVE2AP’s systematic assessment of syntactic, solvability, and semantic correctness.Generated actions must satisfy planning constraints while faithfully representing vulnerability exploitation and logically complete attack progression.Source: A. PDDL-based Attack Path Modeling · pp. 9–10

B. LLM-based PDDL Domain Generation

• Prior LLM-based PDDL systems generated general-purpose planning domains, whereas attack paths additionally require faithful exploitation mechanisms and causal dependencies –.A formally valid and solvable PDDL domain may still fail to represent a real-world cyber attack faithfully.Source: B. LLM-based PDDL Domain Generation · pp. 10–11
• The study uses S3Eval to assess generated attack paths for syntactic correctness, solvability, and vulnerability-specific semantic correctness.This evaluates whether outputs are planner-executable and faithful to vulnerability-exploitation semantics.Source: B. LLM-based PDDL Domain Generation · p. 11

VI. CONCLUSION

• GPT-5.5 provides the most favorable quality-cost trade-off, and error feedback is the most consistently effective quality-improvement strategy.Benefits from few-shot examples and output templates vary.Source: §VI · p. 11