Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs

2022/01/28 by Tyler Cody, Abdul Rahman, Cody, Tyler +17 · 1 citation
Computer Science · #Advanced Malware Detection Techniques #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information and Cyber Security #Machine Learning (cs.LG) #Network Security and Intrusion Detection #Networking and Internet Architecture (cs.NI)

paper · pdf · doi:10.48550/arxiv.2201.12416

openalex publication_date 2022/01/28 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Reinforcement learning (RL), in conjunction with attack graphs and cyber terrain, are used to develop reward and state associated with determination of optimal paths for exfiltration of data in enterprise networks. This work builds on previous crown jewels (CJ) identification that focused on the target goal of computing optimal paths that adversaries may traverse toward compromising CJs or hosts within their proximity. This work inverts the previous CJ approach based on the assumption that data has been stolen and now must be quietly exfiltrated from the network. RL is utilized to support the development of a reward function based on the identification of those paths where adversaries desire reduced detection. Results demonstrate promising performance for a sizable network environment.

Cited by

• From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing

Related

• Exposing Surveillance Detection Routes via Reinforcement Learning, Attack Graphs, and Cyber Terrain
• Enhancing Exfiltration Path Analysis Using Reinforcement Learning
• Crown Jewels Analysis using Reinforcement Learning with Attack Graphs
• Enhancing O-RAN Security: Evasion Attacks and Robust Defenses for Graph Reinforcement Learning-based Connection Management
• A Layered Reference Model for Penetration Testing with Reinforcement Learning and Attack Graphs