Paper deep dive
i-EXAM: Instructable and Explainable Attack Connectivity Graph Modeler
Rakesh Podder, Wadia Ganim, Sarath Sreedharan, Indrajit Ray, Indrakshi Ray
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 88%
Last extracted: 7/8/2026, 3:46:45 AM
Summary
i-EXAM is an interactive, planning-powered security analysis tool that enables system administrators to model complex networks as Attack Connectivity Graphs (ACGs), compile them into PDDL planning problems, and perform what-if analyses to identify and explain network hardening strategies. It integrates automated network scanning, AI planners, and Large Language Models to provide sound, complete, and diverse security posture evaluations with natural language explanations.
Entities (8)
Relation Signals (8)
i-EXAM → buildson → SPEAR framework
confidence 90% · i-EXAM, an interactive tool, built on the SPEAR framework, that leverages state-of-the-art AI planners for network hardening
Attack Connectivity Graph (ACG) → compiledinto → PDDL
confidence 90% · The SPEAR framework proposes how the Attack Connectivity Graph, (ACG) (Podder et al. 2025) a hyper-graph, can be compiled into a PDDL planning problem
i-EXAM → generates → hardening strategies
confidence 90% · generate diverse hardening strategies, and explain these strategies in natural language using Large Language Models.
i-EXAM → uses → llama-3.1-nemotron-70b-instruct
confidence 90% · i-EXAM uses an LLM, specifically llama-3.1-nemotron-70b-instruct (Dubey et al. 2024), to convert the plan failure information into natural language.
i-EXAM → evaluates → Impenetrability metric (M1)
confidence 85% · The first, the impenetrability metric (M1), is defined as F I A (E A ) = 1 iff|E A | = 0, where E A is the set of valid attack paths
i-EXAM → evaluates → Attack difficulty metric (M2)
confidence 85% · The second, the attack difficulty metric (M2), captures the minimum- cost attack path: F D A (E A ) = min{|E| |E ∈E A }.
i-EXAM → uses → FastDownward
confidence 85% · These compiled problems are solved using A* with the LMCut heuristic (Helmert and Domshlak 2009) via Fast-Downward (Helmert 2006).
i-EXAM → uses → Nmap
confidence 85% · It collects detailed system/host-level attributes such as software, version, files, etc. & network-level data (i.e., port, protocol, IP, router, switch) using Nmap, Wazuh, and from documented data.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:i-EXAM is a planning-powered tool that helps system administrators to create security profiles of complex networks and perform what-if analyses to identify network hardening strategies. It leverages planning compilation that provides soundness and completeness guarantees to identify attack paths, evaluate security metrics, generate diverse hardening strategies, and explain these strategies in natural language using Large Language Models.
Tags
Links
- Source: https://arxiv.org/abs/2607.05888v1
- Canonical: https://arxiv.org/abs/2607.05888v1
Trouble viewing inline? Open PDF directly →
Full Text
12,398 characters extracted from source content.
Expand or collapse full text
i-EXAM: Instructable and Explainable Attack Connectivity Graph Modeler Rakesh Podder, Wadia Ganim, Sarath Sreedharan, Indrajit Ray, Indrakshi Ray Colorado State University Fort Collins, Colorado, USA Rakesh.Podder, Wadia.Ganim, Sarath.Sreedharan, Indrajit.Ray, Indrakshi.Ray@colostate.edu Abstract i-EXAM is a planning-powered tool that helps system ad- ministrators to create security profiles of complex networks and perform what-if analyses to identify network harden- ing strategies. It leverages planning compilation that provides soundness and completeness guarantees — to identify attack paths, evaluate security metrics, generate diverse hardening strategies, and explain these strategies in natural language us- ing Large Language Models. Demo Video: https://youtu.be/c4m6EDIpMxM Introduction Securing and administering large networks is challenging: a single modification to a component in the network can have an enormous impact on its overall security posture and re- siliency. The SPEAR framework proposes how the Attack Connectivity Graph, (ACG) (Podder et al. 2025) a hyper- graph, can be compiled into a PDDL planning problem and help system administrators (sysadmins) identify the impact of an attack on the security and functionality of the network. We now present i-EXAM (instructable and EXplainable Attack connectivity graph Modeler), an interactive tool, built on the SPEAR framework, that leverages state-of-the-art AI planners for network hardening (Podder et al. 2025). i- EXAM, allows sysadmins to (a) visualize the overall net- work architecture, (b) run analysis methods to identify the overall security posture, (c) highlight potential attack paths, (d) identify diverse ways to update the network to achieve desired level of functionality or security hardening goals, and (e) generate explanations for the sysadmin as to how the proposed changes would achieve the specified goals. i- EXAM can generate the planning models directly from net- work data and configuration files using a suite of differ- ent planners and enables reasoning about attack paths and defensive strategies with formal guarantees. i-EXAM uses LLMs that interact with the planner to provide explanations in natural language for the sysadmins. i-EXAM Tool Building Planning Models i-EXAM collects detailed system/host-level attributes such as software, version, files, Copyright © 2026, Association for the Advancement of Artificial Intelligence (w.aaai.org). All rights reserved. etc. & network-level data (i.e., port, protocol, IP, router, switch) using Nmap, Wazuh, and from documented data. It utilizes OpenVAS, Wazuh, and other scanners to get up-to-date vulnerability (CVE) information from external databases like NVD, ExploitDB. The information is then represented in JSON format, and used to create a database. This database is used as input to a PDDL generator to auto- matically build planning models. Node/Path Visualizations i-EXAM has a visualization sys- tem, designed to provide sysadmins with views of the secu- rity posture at different levels of abstraction. The network information from the database is loaded to render the entire network as a graph, where each node represents a host and an associated vulnerability, and an edge represents network connections between the hosts. A host having multiple vul- nerabilities is represented as multiple nodes, thus providing a better visualization of attack paths. Clicking on the node allows sysadmins to see additional information like the vul- nerability ID, vulnerability severity scores, including Com- mon Vulnerability Scoring System (CVSS) score, software, versions, file path, capabilities, cause, vulnerability types, and functionalities. i-EXAM allows visualization of poten- tial paths, which are calculated from the planning model and then overlaid on this visualization. It uses a top-k-planner (Katz et al. 2018) to visualize multiple attack paths to the same target node. Network-Level Analysis While i-EXAM can support any analysis that can be performed over an ACG, we focus on two metrics (Podder et al. 2025). The first, the impenetra- bility metric (M1), is defined asF I A (E A ) = 1 iff|E A | = 0, whereE A is the set of valid attack paths — a binary in- dicator of whether any valid attack path exists. Its plan- ning compilation directly encodes the ACG into a plan- ning modelM G where fluents represent host-attribute pairs, actions represent attack/connectivity edges, and the target attribute becomes the goal; by Theorem 1 (Podder et al. 2025), a plan exists iff an attack path exists. The second, the attack difficulty metric (M2), captures the minimum- cost attack path: F D A (E A ) = min|E| |E ∈E A . Since M2 requires minimizing over multiple attacker initial po- sitions and targets simultaneously, its compilation intro- duces auxiliary fluents (init changemode, actmode, goalreached) that allow the planner to select the cheap- est attacker scenario, with optimal plan cost equal to F D A arXiv:2607.05888v1 [cs.CR] 7 Jul 2026 (Proposition 4, (Podder et al. 2025)). Both metrics enforce F 1 C , ensuring hardening strategies preserve service connec- tivity. These compiled problems are solved usingA ∗ with the LMCut heuristic (Helmert and Domshlak 2009) via Fast- Downward (Helmert 2006). What-If-Analysis Security posture improvement consists of a set of modifications to the network that is designed to re- duce the metric values, while ensuring that the changes don’t affect the availability of hosted services. Note that, ACG, in- stead of more traditional attack graphs (Ou, Govindavajhala, and Appel 2005), allows us to simultaneously reason about both attacks and functionalities. Following the formulation set in previous works (cf. (Srivastava et al. 2007)), i-EXAM leverages a diverse solution selection, which will then be shown to the sysadmin. The diversity ensures that each set of modifications focuses on different components of the net- work. This allows i-EXAM to account for the fact that the cost of a modification is quite hard to capture exactly, and may depend on a number of factors, including the expertise of the sysadmin and the availability of technicians. By pro- viding sysadmins multiple diverse solutions, they will be in a position to make an informed choice. Explanation Generation i-EXAM also provides an expla- nation as to why the proposed modifications will help reduce the target metric. For this, i-EXAM leverages a modified version of explanations by model restriction (Krarup et al. 2021), wherein it presents multiple counterfactual plans that would have satisfied previous metric value and how they are invalidated by the proposed changes. i-EXAM uses an LLM, specifically llama-3.1-nemotron-70b-instruct (Dubey et al. 2024), to convert the plan failure information into natural language. This allows the tool to be easily used by sysadmin who may not have expertise on automated planning systems. Instantiation of i-EXAM Fig. 1 is a screenshot from a case-study where i-EXAM was instantiated with a test network given the system configu- rations, network connectivity, CVEs, and a list of possible targets/goals. As shown in Fig. 1, if the sysadmin selects a target to inspect (automatically highlighted in the visual graph), i-EXAM presents a plan to compromise the target. When the impenetrability metric is selected, i-EXAM out- puts an attack plan and its cost, then prompts to explore proposed changes that would eliminate attack paths for the target. i-EXAM presents diverse modification options to the sysadmin; upon selecting a modification option, the tool pro- duces the corresponding solution and an explanation as to why no attack plan exists under that option. Similarly, un- der attack difficulty metric, i-EXAM prompts the sysadmin to select attacker initial positions; upon selection, it presents the optimal plan and cost, then prompts to explore proposed changes that would harden the network (by increasing cost of the attack plan). Once an option is selected, the tool ap- plies the modification, recomputes the minimum-cost attack plan, and presents the results with an explanation of why the cost of attack has increased. Figure 1: i-EXAM’s Visual Interaction UI. Discussion Robustness. i-EXAM inherits SPEAR’s soundness and completeness guarantees ((Podder et al. 2025), Theorem 1) such that any valid plan in the model corresponds to a valid attack or connectivity path in the ACG, and vice versa. A* search with the LMCut heuristic guarantees optimal hard- ening solutions when costs are specified. Diverse solution sets further guard against impracticality — if one hardening strategy cannot be implemented, alternatives remain. Generalization. The domain independent nature of PDDL- based ACG formalism generalizes across arbitrary network topologies and vulnerability combinations. The automated pipeline (Nmap, Wazuh, OpenVAS → Structure JSON → PDDL) constructs planning models for any network without manual modeling effort. The LLM explanation component generalizes across different plan-failure scenarios without task-specific fine-tuning, translating structured counterfac- tual plan traces into natural language for any network. Scalability. i-EXAM uses FastDownward with LMCut for plan computation and a modified A* search over model space for hardening. Empirical evaluation on networks of 30 nodes (Podder et al. 2025) shows that heuristic guid- ance consistently reduces computation time (∼50%) across both impenetrability and attack difficulty metrics. The top-k planner enables enumeration of diverse attack paths even in larger networks. Deployment Effort. Sysadmins require no knowledge of PDDL or AI planning. i-EXAM automates model construc- tion from standard network scan outputs. The only inputs required are network access for scanning and a specification of target nodes and security goals. The human-in-the-loop design ensures administrators can apply domain judgment when selecting among diverse hardening options. Conclusion & Future Work i-EXAM bridges formal AI planning theory and real-world network security, demonstrating how PDDL-based reason- ing and LLMs can be combined to make planning-based security analysis accessible to sysadmins. Future work in- cludes learned cost functions for hardening actions, usability studies with domain experts, and extension to larger enter- prise networks. Acknowledgment This work was partially supported by the U.S. Office of Naval Research under award N000142612041. The opin- ions, results, conclusions, and suggestions presented in this work are those of the authors and do not necessarily repre- sent those of the Office of Naval Research or other organi- zations and agencies. References Dubey, A.; Jauhri, A.; Pandey, A.; Kadian, A.; Al-Dahle, A.; Letman, A.; Mathur, A.; Schelten, A.; Yang, A.; Fan, A.; et al. 2024. The Llama 3 Herd of Models. arXiv e-prints, arXiv–2407. Helmert, M. 2006. The Fast Downward Planning System. Journal of Artificial Intelligence Research, 26: 191–246. Helmert, M.; and Domshlak, C. 2009. Landmarks, Critical Paths and Abstractions: What’s the Difference Anyway? In Proceedings of the International Conference on Automated Planning and Scheduling, volume 19, 162–169. Katz, M.; Sohrabi, S.; Udrea, O.; and Winterer, D. 2018. A Novel Iterative Approach to Top-k Planning. In Proceed- ings of the Twenty-Eighth International Conference on Au- tomated Planning and Scheduling (ICAPS 2018), 132–140. AAAI Press. Krarup, B.; Krivic, S.; Magazzeni, D.; Long, D.; Cashmore, M.; and Smith, D. E. 2021. Contrastive Explanations of Plans through Model Restrictions. Journal of Artificial In- telligence Research, 72: 533–612. Ou, X.; Govindavajhala, S.; and Appel, A. W. 2005. Mul- VAL: A Logic-Based Network Security Analyzer. In Pro- ceedings of the 14th Conference on USENIX Security Sym- posium, volume 8 of SSYM’05, 113–128. Baltimore, MD, USA: USENIX Association. Podder, R.; Caglar, T.; Bashir, S. K.; Sreedharan, S.; Ray, I.; and Ray, I. 2025. SPEAR: Security Posture Evaluation using AI Planner-Reasoning on Attack-Connectivity Hyper- graphs. In Proceedings of the 30th ACM Symposium on Ac- cess Control Models and Technologies, 62–73. Srivastava, B.; Nguyen, T. A.; Gerevini, A.; Kambhampati, S.; Do, M. B.; and Serina, I. 2007. Domain Independent Ap- proaches for Finding Diverse Plans. In IJCAI, 2016–2022.