🤖 AI

i-EXAM: Instructable and Explainable Attack Connectivity Graph Modeler

i-EXAM is a planning-powered tool that enables system administrators to model complex network security, identify attack paths, and generate and explain diverse hardening strategies using Large Language Models with soundness and completeness guarantees.

Original authors: Rakesh Podder, Wadia Ganim, Sarath Sreedharan, Indrajit Ray, Indrakshi Ray

Published 2026-07-08

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Rakesh Podder, Wadia Ganim, Sarath Sreedharan, Indrajit Ray, Indrakshi Ray

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your computer network is a massive, intricate castle with thousands of rooms, secret passages, and guards. The job of the "Sysadmin" (System Administrator) is to keep this castle safe from intruders. But here's the problem: the castle is so big and complex that if you move one stone or lock one door, you might accidentally trap the king inside or leave a secret tunnel wide open. It's hard to know what will happen before you actually do it.

Enter i-EXAM, a new digital tool designed to help these castle guardians plan their defenses without having to guess.

The "What-If" Simulator

Think of i-EXAM as a high-tech flight simulator for security. Just as a pilot practices flying in a storm before taking off, a Sysadmin can use i-EXAM to run "what-if" scenarios.

The Input: The tool automatically scans the castle (the network) to see what software is running, what doors (ports) are open, and where the cracks in the walls (vulnerabilities) are. It gathers this info from standard security tools and turns it into a digital map.
The Engine: Under the hood, i-EXAM uses a powerful "planner" (a type of AI logic engine). This planner is like a super-smart chess grandmaster that can calculate every possible way a thief could break in. It doesn't just guess; it mathematically proves exactly how an attack would happen.

Seeing the Invisible

One of the coolest features is the visual map.

Imagine looking at a 3D model of your castle where every room is a dot and every hallway is a line.
If a room has a weak lock (a vulnerability), i-EXAM highlights it.
If a thief could sneak from the front gate to the treasure room, the tool draws a glowing red line showing that exact path.
You can click on any part of the map to see details, like "This door is weak because the lock is 10 years old."

The "Fix-It" Menu

Once the tool shows you how a thief could break in, it doesn't just stop there. It acts like a creative architect offering different renovation plans.

The Problem: Sometimes, fixing one hole might accidentally block the mailman from delivering letters (breaking a service).
The Solution: i-EXAM offers a list of different ways to fix the castle. Maybe you can change the lock on the front door, or maybe you can add a guard to the side gate. It gives you several diverse options so you can choose the one that fits your budget and your team's skills.
The Guarantee: The tool promises that whatever plan it suggests will actually stop the thief and keep the mail flowing. It's mathematically proven to work.

Talking Like a Human

Here is where the tool gets really friendly. Usually, these security plans are written in a complex computer code that only experts understand.

The Translator: i-EXAM uses a "Large Language Model" (a very advanced AI that speaks human language) to translate the computer's math into plain English.
The Explanation: Instead of saying "Action A invalidates Path B," it tells the Sysadmin: "If you replace the lock on the library door, the thief can no longer sneak in through the window because the new lock triggers an alarm that blocks their path."
It explains why a change works, making it easy for anyone to understand the logic behind the security upgrade.

Why It Matters

The paper claims this tool is special because:

It's Automatic: It builds the complex security models by itself from standard scan data, so the Sysadmin doesn't need to be a math genius.
It's Reliable: It uses strict mathematical rules to ensure the plans it generates are actually possible and effective.
It's Fast: Even for big networks, it finds the best solutions quickly.
It's Flexible: It can handle any type of network layout, from a small office to a huge enterprise.

In short, i-EXAM takes the scary, complex math of network security and turns it into a clear, interactive game where you can see the threats, try out different defenses, and get a plain-English explanation of why your new plan will keep the castle safe.

Technical Summary of i-EXAM: Instructable and Explainable Attack Connectivity Graph Modeler

Problem Statement
Securing and administering large-scale networks is inherently challenging because a single modification to a network component can drastically alter the overall security posture and resiliency. Traditional approaches often struggle to simultaneously reason about attack vectors and network functionality. While the SPEAR framework previously proposed using an Attack Connectivity Graph (ACG)—a hypergraph compiled into a PDDL planning problem—to identify attack impacts, there remains a need for an interactive, accessible tool that allows system administrators (sysadmins) to visualize these complex relationships, perform "what-if" analyses, and understand the rationale behind security hardening strategies without requiring expertise in automated planning systems.

Methodology
i-EXAM is an interactive tool built upon the SPEAR framework that integrates state-of-the-art AI planners with Large Language Models (LLMs) to model, analyze, and explain network security. The methodology proceeds through four primary stages:

Data Collection and Model Construction:
i-EXAM automates the creation of planning models by collecting system and network-level attributes (software, versions, ports, protocols, IPs) using tools like Nmap, Wazuh, and documented data. It retrieves up-to-date vulnerability (CVE) information from external databases (NVD, ExploitDB) via scanners like OpenVAS. This data is structured into JSON and fed into a PDDL generator to automatically construct planning models. The underlying formalism compiles the ACG into a planning model ( $M_G$ ) where fluents represent host-attribute pairs, actions represent attack/connectivity edges, and target attributes serve as goals.
Visualization and Analysis:
The tool renders the network as a graph where nodes represent hosts and associated vulnerabilities, and edges represent connections. It supports multi-level abstraction, allowing users to click nodes for detailed metadata (CVSS scores, file paths, etc.). i-EXAM utilizes a top-k-planner to visualize multiple potential attack paths to a target.
The system focuses on two specific security metrics derived from the ACG:
- Impenetrability Metric ( $M_1$ ): A binary indicator ( $F^I_A(E_A) = 1$ ) determining if any valid attack path exists ( $|E_A| = 0$ ).
- Attack Difficulty Metric ( $M_2$ ): Captures the minimum-cost attack path ( $F^D_A(E_A) = \min\{|E| \mid E \in E_A\}$ ).
  Both metrics enforce $F^1_C$ , ensuring that hardening strategies preserve service connectivity. These problems are solved using A* search with the LMCut heuristic via the Fast-Downward planner.
What-If Analysis and Diverse Solution Selection:
To improve security posture, i-EXAM identifies network modifications that reduce metric values while maintaining service availability. Unlike traditional attack graphs, the ACG allows simultaneous reasoning about attacks and functionalities. The system employs a diverse solution selection strategy, generating multiple modification sets that focus on different network components. This approach acknowledges that the "cost" of a modification is difficult to quantify precisely and depends on factors like sysadmin expertise and technician availability, thereby empowering administrators to make informed choices among varied options.
Explanation Generation:
To bridge the gap between formal planning outputs and human understanding, i-EXAM uses an LLM (specifically llama-3.1-nemotron-70b-instruct) to generate natural language explanations. It leverages a modified version of "explanations by model restriction," presenting counterfactual plans that would have satisfied previous metric values and explaining how the proposed changes invalidate those plans.

Key Contributions

Interactive Tooling: i-EXAM provides a user-friendly interface for sysadmins to visualize network architecture, highlight attack paths, and explore hardening strategies without needing knowledge of PDDL or AI planning.
Formal Guarantees: By inheriting the SPEAR framework's soundness and completeness guarantees, i-EXAM ensures that any valid plan in the model corresponds to a valid attack or connectivity path in the ACG, and vice versa.
Automated Pipeline: The tool automates the entire pipeline from network scanning (Nmap, Wazuh, OpenVAS) to PDDL model construction, eliminating the need for manual modeling.
Explainability via LLMs: It integrates LLMs to translate structured counterfactual plan traces into natural language, making the rationale for security recommendations accessible to non-experts.
Diverse Strategy Generation: The system generates diverse hardening strategies to account for the uncertainty in implementation costs and constraints.

Results and Performance
Empirical evaluations on networks with approximately 30 nodes (as cited in Podder et al. 2025) demonstrate that heuristic guidance (LMCut) consistently reduces computation time by approximately 50% across both impenetrability and attack difficulty metrics. The top-k-planner successfully enumerates diverse attack paths even in larger networks. The system successfully instantiates in case studies where it can automatically highlight targets, present attack plans with costs, and generate diverse modification options with corresponding explanations for why those options eliminate or increase the cost of attacks.

Significance and Claims
The paper positions i-EXAM as a bridge between formal AI planning theory and real-world network security operations. Its primary significance lies in making planning-based security analysis accessible to system administrators through automation and natural language explanation. The authors claim that the domain-independent nature of the PDDL-based ACG formalism allows the tool to generalize across arbitrary network topologies and vulnerability combinations without task-specific fine-tuning. Furthermore, the human-in-the-loop design ensures that administrators can apply domain judgment when selecting among diverse hardening options, while the tool handles the complex computational reasoning. The work is presented as a step toward more resilient network management, with future work proposed for learned cost functions, usability studies with domain experts, and scaling to larger enterprise networks.