Practical Fixed-Parameter Algorithms for Defending Active Directory Style Attack Graphs
Mingyu Guo, Jialiang Li, Aneta Neumann, Frank Neumann, Hung Nguyen

TL;DR
This paper develops fixed-parameter algorithms and a neural network heuristic to defend Active Directory attack graphs, exploiting their small attack path lengths and tree-like structures for efficient security strategies.
Contribution
It introduces fixed-parameter algorithms tailored for Active Directory attack graphs and a neural network heuristic, advancing defense strategies for complex network structures.
Findings
Small attack path lengths enable fixed-parameter algorithms.
Tree-like structures facilitate efficient defense algorithms.
Neural network heuristic scales to larger graphs.
Abstract
Active Directory is the default security management system for Windows domain networks. We study the shortest path edge interdiction problem for defending Active Directory style attack graphs. The problem is formulated as a Stackelberg game between one defender and one attacker. The attack graph contains one destination node and multiple entry nodes. The attacker's entry node is chosen by nature. The defender chooses to block a set of edges limited by his budget. The attacker then picks the shortest unblocked attack path. The defender aims to maximize the expected shortest path length for the attacker, where the expectation is taken over entry nodes. We observe that practical Active Directory attack graphs have small maximum attack path lengths and are structurally close to trees. We first show that even if the maximum attack path length is a constant, the problem is still -hard…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
Taxonomy
TopicsInformation and Cyber Security · Smart Grid Security and Resilience · Infrastructure Resilience and Vulnerability Analysis
