Crown Jewels Analysis using Reinforcement Learning with Attack Graphs

Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs

“…Most frequently, RL is tasked with simply traversing a network from one initial node to one terminal node-(i.e., finding paths through networks) [2]- [9]. Gangupantulu et al, in contrast, emphasize a more complex task of using RL to perform CJ analysis [10]. Here, similar to Gangupantulu et al, the presented RL method solves a more complex task and serves as a targeted tool for cyber operators to improve the efficiency of operator workflow in penetration testing.…”

“…While deep RL has been applied to cybersecurity broadly [21], it has only recently been pursued as a tool for penetration testing [2]- [10]. While approaches and uses vary greatly, many use attack graphs to model the network [22].…”

“…RL for penetration testing has made frequent use of DQN [3], [7]- [10]. Nguyen et al, alternatively, propose an RL-based approach to penetration testing that uses two agents: one for iteratively scanning the network to build a structural model and another for exploiting the constructed model [23].…”

“…Additionally, while RL for MDPs is well-established, RL for POMDPs is still under fundamental development [27]. Currently, MDPs are the standard in RL for penetration testing [2]- [10].…”

“…Much of the literature on automating penetration testing using RL has a focus on the way networks can be accessed (i.e., infiltration [2]- [10]). And while some consider using RL to detect exfiltration [11], [12], RL for conducting postexploitation activities like exfiltration are under-studied [13].…”