Learning Policies for Path Selection in Attack Graphs

Table of contents

• Quick Info
  • Project links
• Description
• How to use
• Work Products
• Resources

Quick Info

• Student: Manuel Rickli
• Supervisor: Pontus Johnson
• Examiner: György Dán
• Active members:
  • Sotirios Katsikeas
• Status: Finished
• Timeline: VT-21

Project links

• Overleaf project

Description

Attack simulation provides insight over an attacker's capabilities within a system. In order to have a more meaningful simulation, the attacker should realistically only be able to partially observe the system and make decisions based on the current information available.
This work aims to clarify the question of how well a neural network can approximate the optimal policy of a partially observable attack graph. The generated attack graphs used for supervised learning are heavily inspired by coreLang.

How to use

• Generate attack graphs with prefixes train, val and test and save them in AttackGraphs
• Modify the training configuration in value_approximator/gat/train.py
• Run the training
• Optionally, test the prediction accuracy with the trained model that saved in models/binaries (the final model) or models/checkpoints

Work Products

• Build attack graph from generated model
• Calculated value function
• Adapt GNN for attack graphs
• First GNN learning on attack graphs
• Analyse results
• Reiterate learning and conclude

Resources

• MAL - Meta Attack Language

---

This is a project run by the Software Systems Architecture and Security research group within the Division of Network and Systems Engineering at the Department of Computer Science at the School of Electrical Engineering and Computer Science @ KTH university.

For more of our projects, see the SSAS page at github.com.