Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs

TL;DR

This paper applies reinforcement learning with attack graphs to identify covert data exfiltration paths in enterprise networks, focusing on stealthy routes adversaries might use after stealing data.

Contribution

It introduces a novel approach that inverts previous crown jewel identification methods, using RL to find low-detection exfiltration paths in cyber terrain.

Findings

Promising performance in sizable network environments

Effective identification of stealthy exfiltration paths

Enhanced understanding of adversarial exfiltration strategies

Abstract

Reinforcement learning (RL), in conjunction with attack graphs and cyber terrain, are used to develop reward and state associated with determination of optimal paths for exfiltration of data in enterprise networks. This work builds on previous crown jewels (CJ) identification that focused on the target goal of computing optimal paths that adversaries may traverse toward compromising CJs or hosts within their proximity. This work inverts the previous CJ approach based on the assumption that data has been stolen and now must be quietly exfiltrated from the network. RL is utilized to support the development of a reward function based on the identification of those paths where adversaries desire reduced detection. Results demonstrate promising performance for a sizable network environment.