Using PDDL to find privilege escalation paths
usenix.org