Exposing Surveillance Detection Routes via Reinforcement Learning, Attack Graphs, and Cyber Terrain

Reinforcement learning (RL) operating on attack graphs leveraging cyber terrain principles are used to develop reward and state associated with determination of surveillance detection routes (SDR). This work extends previous efforts on developing RL methods for path analysis within enterprise networ...

Full description

Saved in:
Bibliographic Details
Published in2022 21st IEEE International Conference on Machine Learning and Applications (ICMLA) pp. 1350 - 1357
Main Authors Huang, Lanxiao, Cody, Tyler, Redino, Christopher, Rahman, Abdul, Kakkar, Akshay, Kushwaha, Deepak, Wang, Cheng, Clark, Ryan, Radke, Daniel, Beling, Peter, Bowen, Edward
Format Conference Proceeding
LanguageEnglish
Published IEEE 01.12.2022
Subjects
attack graphs
Buildings
cyber terrain
Data models
MIMICs
Production
Reinforcement learning
SDR
Sensitivity
Surveillance
surveillance detection routes
Online AccessGet full text

Cover

More Information
Summary:Reinforcement learning (RL) operating on attack graphs leveraging cyber terrain principles are used to develop reward and state associated with determination of surveillance detection routes (SDR). This work extends previous efforts on developing RL methods for path analysis within enterprise networks. This work focuses on building SDR where the routes focus on exploring the network services while trying to evade risk. RL is utilized to support the development of these routes by building a reward mechanism that would help in realization of these paths. The RL algorithm is modified to have a novel warm-up phase which decides in the initial exploration which areas of the network are safe to explore based on the rewards and penalty scale factor.
DOI:10.1109/ICMLA55696.2022.00282