Please use this identifier to cite or link to this item:
https://hdl.handle.net/2440/136639
Citations | ||
Scopus | Web of Science® | Altmetric |
---|---|---|
?
|
?
|
Type: | Conference paper |
Title: | Defending active directory by combining neural network based dynamic program and evolutionary diversity optimisation |
Author: | Goel, D. Ward-Graham, M.H. Neumann, A. Neumann, F. Nguyen, H. Guo, M. |
Citation: | Proceedings of the Genetic and Evolutionary Computation Conference (GECCO'22), 2022 / Fieldsend, J.E., Wagner, M. (ed./s), vol.abs/2204.03397, pp.1191-1199 |
Publisher: | Association for Computing Machinery |
Publisher Place: | New York, NY |
Issue Date: | 2022 |
ISBN: | 9781450392372 |
Conference Name: | Genetic and Evolutionary Computation Conference (GECCO) (9 Jul 2022 - 13 Jul 2022 : virtual online) |
Editor: | Fieldsend, J.E. Wagner, M. |
Statement of Responsibility: | Diksha Goel, Max Hector Ward-Graham, Aneta Neumann, Frank Neumann, Hung Nguyen, Mingyu Guo |
Abstract: | Active Directory (AD) is the default security management system for Windows domain networks.We study a Stackelberg game model between one attacker and one defender on an AD attack graph. The attacker initially has access to a set of entry nodes. The attacker can expand this set by strategically exploring edges. Every edge has a detection rate and a failure rate. The attacker aims to maximize their chance of successfully reaching the destination before getting detected. The defender’s task is to block a constant number of edges to decrease the attacker’s chance of success. We show that the problem is #P-hard and, therefore, intractable to solve exactly. We convert the attacker’s problem to an exponential sized Dynamic Program that is approximated by a Neural Network (NN). Once trained, the NN provides an efficient fitness function for the defender’s Evolutionary Diversity Optimisation (EDO). The diversity emphasis on the defender’s solution provides a diverse set of training samples, which improves the training accuracy of our NN for modelling the attacker. We go back and forth between NN training and EDO. Experimental results show that for R500 graph, our proposed EDO based defense is less than 1% away from the optimal defense. |
Keywords: | Attack graph; evolutionary diversity optimisation; neural networks |
Rights: | © 2022 Copyright held by the owner/author(s). Publication rights licensed to ACM. |
DOI: | 10.1145/3512290.3528729 |
Grant ID: | http://purl.org/au-research/grants/arc/DP190103894 http://purl.org/au-research/grants/arc/FT200100536 |
Published version: | https://dl.acm.org/doi/proceedings/10.1145/3512290 |
Appears in Collections: | Computer Science publications |
Files in This Item:
There are no files associated with this item.
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.