论文标题
使用攻击图的增强学习发现渗透路径
Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs
论文作者
论文摘要
加强学习（RL）与攻击图和网络地形结合使用，用于开发与确定企业网络中数据渗透的最佳路径相关的奖励和状态。这项工作建立在先前的皇冠珠宝（CJ）识别的基础上，该标识集中在计算对手可能跨越其接近性CJ或宿主的最佳路径的目标目标。这项工作基于以下假设，即数据已被盗，现在必须悄悄地从网络中删除。基于对手希望减少检测的那些路径的识别，RL用于支持奖励功能的发展。结果证明了相当大的网络环境的表现。
Reinforcement learning (RL), in conjunction with attack graphs and cyber terrain, are used to develop reward and state associated with determination of optimal paths for exfiltration of data in enterprise networks. This work builds on previous crown jewels (CJ) identification that focused on the target goal of computing optimal paths that adversaries may traverse toward compromising CJs or hosts within their proximity. This work inverts the previous CJ approach based on the assumption that data has been stolen and now must be quietly exfiltrated from the network. RL is utilized to support the development of a reward function based on the identification of those paths where adversaries desire reduced detection. Results demonstrate promising performance for a sizable network environment.
