Leveraging Deep Reinforcement Learning for Cyber-Attack Paths Prediction: Formulation, Generalization, and Evaluation - Archive ouverte HAL
Communication Dans Un Congrès Année : 2024

Leveraging Deep Reinforcement Learning for Cyber-Attack Paths Prediction: Formulation, Generalization, and Evaluation

Résumé

Attack paths represent the sequences of network nodes compromised by attackers while exploiting their respective vulnerabilities. Current methods for predicting such attack paths largely depend on existing human expertise or established heuristics. These traditional methods are time-consuming and require highly skilled threat-hunting analysts to identify these attack paths and proactively apply security measures. However, the task becomes challenging when facing large-scale and highly vulnerable networks. In this paper, we propose an alternative approach leveraging Deep Reinforcement Learning (DRL) techniques aiming to approximate the decision-making of attackers. Our approach embodies the attacker’s perspective and tactics to leverage discovered paths for proactive security analysis and establish defense strategies. We introduce a novel re-formulation of the problem with a local view for the DRL agent, representing the source and target node of the attack at each timestep. Additionally, our training methodology involves a diverse set of network topologies of different sizes and exploitable vulnerabilities, demonstrating the ability of DRL algorithms to navigate topologies, identify attack paths, and compromise nodes. Results highlight the capability of the learned policies to generalize within entirely new topologies, arriving to discover 80% ± 0.08% of the attack paths in 1500 steps.
Fichier principal
Vignette du fichier
Leveraging_Deep_Reinforcement_Learning_for_Cyber_Attack_Paths_Prediction__Formulation__Generalization__and_Evaluation.pdf (1 Mo) Télécharger le fichier
Origine Fichiers produits par l'(les) auteur(s)

Dates et versions

hal-04662428 , version 1 (25-07-2024)

Licence

Identifiants

Citer

Franco Terranova, Abdelkader Lahmadi, Isabelle Chrisment. Leveraging Deep Reinforcement Learning for Cyber-Attack Paths Prediction: Formulation, Generalization, and Evaluation. The 27th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2024), Sep 2024, Padua, Italy. ⟨10.1145/3678890.3678902⟩. ⟨hal-04662428⟩
385 Consultations
237 Téléchargements

Altmetric

Partager

More