Deep Reinforcement Learning for Automated Cyber-Attack Path Prediction in Communication Networks - Archive ouverte HAL
Poster De Conférence Année : 2024

Deep Reinforcement Learning for Automated Cyber-Attack Path Prediction in Communication Networks

Apprentissage par renforcement pour la prévision automatisée du chemin des cyberattaques dans les réseaux de communication

Résumé

Building an intelligent agent that mimics attackers and autonomously identifies attack paths in a network has emerged as a crucial strategy for discovering and keeping control over potential security breaches in a communication network. A full and realistic automation of network security analysis necessitates discarding assumptions about prior knowledge of the network structure, hence the process should not be considered completely observable. Instead, it should be treated as a black box that is partially observable and dynamically discoverable. This can be achieved through the use of deep reinforcement learning (RL) and representing the target network as a graph-based Partially Observable Markov Decision Process (POMDP). We have been utilizing CyberBattleSim, an experimental research platform that is designed to offer a simulated and abstract network environment, suited for RL training. We have enhanced its partial observability and redefined the observation and action spaces to deal with a local abstraction of the problem, allowing a neural network structure that is generalizable among topologies. The observation space will consist of partially visible evolving features for the source and the target nodes of the attack. The set of all possible exploitable vulnerabilities will instead represent the action space. Preliminary convergence results were obtained with a CyberBattleSim environment that represents a chain of alternating Windows and Linux vulnerable nodes that lead to a terminal node with a goal flag. These initial results demonstrate the potential of value-based, policy-based, and actor-critic techniques to discover an optimal policy for compromising all network nodes, regardless of the chain size, in approximately the least number of steps possible.
Fichier principal
Vignette du fichier
Poster.pdf (636.26 Ko) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04462876 , version 1 (16-02-2024)

Identifiants

  • HAL Id : hal-04462876 , version 1

Citer

Franco Terranova, Abdelkader Lahmadi, Isabelle Chrisment. Deep Reinforcement Learning for Automated Cyber-Attack Path Prediction in Communication Networks. Geilo Winter School 2024 - Graphs and Applications, Jan 2024, Geilo, Norway. ⟨hal-04462876⟩
200 Consultations
133 Téléchargements

Partager

More