Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs

Reinforcement learning (RL), in conjunction with attack graphs and cyber terrain, are used to develop reward and state associated with determination of optimal paths for exfiltration of data in enterprise networks. This work builds on previous crown jewels (CJ) identification that focused on the target goal of computing optimal paths that adversaries may traverse toward compromising CJs or hosts within their proximity. This work inverts the previous CJ approach based on the assumption that data has been stolen and now must be quietly exfiltrated from the network. RL is utilized to support the development of a reward function based on the identification of those paths where adversaries desire reduced detection. Results demonstrate promising performance for a sizable network environment.

I. Introduction

The National Institute of Standards and Technology (NIST) special publication 800–53 revision 5 states that ex filtration¹

NIST 800-53r5 [1] states specifically that ex filtration lies within security control SC-07 (10) for boundary protection to prevent unauthorized data movement (exfiltration).

(also called exfil) is the unauthorized movement of data within a network [1]. Many times, cyber attacks are considered successful if they exfiltrate data for monetary, disruptive, or competitive gain. Detection of exfiltration can be plagued with technical challenges as adversaries routinely encapsulate data within typically allowable protocols (e.g., http(s), DNS) which make it significantly harder to defend. Additionally, adver-saries have been known to prefer traversing certain network paths for data theft to reduce detection and tripping cyber defenses so they do not raise suspicions.