-
Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations
Authors:
Cheng Wang,
Christopher Redino,
Ryan Clark,
Abdul Rahman,
Sal Aguinaga,
Sathvik Murli,
Dhruv Nandakumar,
Roland Rao,
Lanxiao Huang,
Daniel Radke,
Edward Bowen
Abstract:
Ransomware presents a significant and increasing threat to individuals and organizations by encrypting their systems and not releasing them until a large fee has been extracted. To bolster preparedness against potential attacks, organizations commonly conduct red teaming exercises, which involve simulated attacks to assess existing security measures. This paper proposes a novel approach utilizing…
▽ More
Ransomware presents a significant and increasing threat to individuals and organizations by encrypting their systems and not releasing them until a large fee has been extracted. To bolster preparedness against potential attacks, organizations commonly conduct red teaming exercises, which involve simulated attacks to assess existing security measures. This paper proposes a novel approach utilizing reinforcement learning (RL) to simulate ransomware attacks. By training an RL agent in a simulated environment mirroring real-world networks, effective attack strategies can be learned quickly, significantly streamlining traditional, manual penetration testing processes. The attack pathways revealed by the RL agent can provide valuable insights to the defense team, helping them identify network weak points and develop more resilient defensive measures. Experimental results on a 152-host example network confirm the effectiveness of the proposed approach, demonstrating the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files strategically placed to detect unauthorized access).
△ Less
Submitted 25 June, 2024;
originally announced June 2024.
-
Growing Better Graphs With Latent-Variable Probabilistic Graph Grammars
Authors:
Xinyi Wang,
Salvador Aguinaga,
Tim Weninger,
David Chiang
Abstract:
Recent work in graph models has found that probabilistic hyperedge replacement grammars (HRGs) can be extracted from graphs and used to generate new random graphs with graph properties and substructures close to the original. In this paper, we show how to add latent variables to the model, trained using Expectation-Maximization, to generate still better graphs, that is, ones that generalize better…
▽ More
Recent work in graph models has found that probabilistic hyperedge replacement grammars (HRGs) can be extracted from graphs and used to generate new random graphs with graph properties and substructures close to the original. In this paper, we show how to add latent variables to the model, trained using Expectation-Maximization, to generate still better graphs, that is, ones that generalize better to the test data. We evaluate the new method by separating training and test graphs, building the model on the former and measuring the likelihood of the latter, as a more stringent test of how well the model can generalize to new graphs. On this metric, we find that our latent-variable HRGs consistently outperform several existing graph models and provide interesting insights into the building blocks of real world networks.
△ Less
Submitted 11 June, 2018;
originally announced June 2018.
-
Learning Hyperedge Replacement Grammars for Graph Generation
Authors:
Salvador Aguinaga,
David Chiang,
Tim Weninger
Abstract:
The discovery and analysis of network patterns are central to the scientific enterprise. In the present work, we developed and evaluated a new approach that learns the building blocks of graphs that can be used to understand and generate new realistic graphs. Our key insight is that a graph's clique tree encodes robust and precise information. We show that a Hyperedge Replacement Grammar (HRG) can…
▽ More
The discovery and analysis of network patterns are central to the scientific enterprise. In the present work, we developed and evaluated a new approach that learns the building blocks of graphs that can be used to understand and generate new realistic graphs. Our key insight is that a graph's clique tree encodes robust and precise information. We show that a Hyperedge Replacement Grammar (HRG) can be extracted from the clique tree, and we develop a fixed-size graph generation algorithm that can be used to produce new graphs of a specified size. In experiments on large real-world graphs, we show that graphs generated from the HRG approach exhibit a diverse range of properties that are similar to those found in the original networks. In addition to graph properties like degree or eigenvector centrality, what a graph "looks like" ultimately depends on small details in local graph substructures that are difficult to define at a global level. We show that the HRG model can also preserve these local substructures when generating new graphs.
△ Less
Submitted 23 February, 2018; v1 submitted 20 February, 2018;
originally announced February 2018.
-
A Temporal Tree Decomposition for Generating Temporal Graphs
Authors:
Corey Pennycuff,
Salvador Aguinaga,
Tim Weninger
Abstract:
Discovering the underlying structures present in large real world graphs is a fundamental scientific problem. Recent work at the intersection of formal language theory and graph theory has found that a Hyperedge Replacement Grammar (HRG) can be extracted from a tree decomposition of any graph. This HRG can be used to generate new graphs that share properties that are similar to the original graph.…
▽ More
Discovering the underlying structures present in large real world graphs is a fundamental scientific problem. Recent work at the intersection of formal language theory and graph theory has found that a Hyperedge Replacement Grammar (HRG) can be extracted from a tree decomposition of any graph. This HRG can be used to generate new graphs that share properties that are similar to the original graph. Because the extracted HRG is directly dependent on the shape and contents of the of tree decomposition, it is unlikely that informative graph-processes are actually being captured with the extraction algorithm. To address this problem, the current work presents a new extraction algorithm called temporal HRG (tHRG) that learns HRG production rules from a temporal tree decomposition of the graph. We observe problems with the assumptions that are made in a temporal HRG model. In experiments on large real world networks, we show and provide reasoning as to why tHRG does not perform as well as HRG and other graph generators.
△ Less
Submitted 28 June, 2017;
originally announced June 2017.
-
Growing Graphs with Hyperedge Replacement Graph Grammars
Authors:
Salvador Aguiñaga,
Rodrigo Palacios,
David Chiang,
Tim Weninger
Abstract:
Discovering the underlying structures present in large real world graphs is a fundamental scientific problem. In this paper we show that a graph's clique tree can be used to extract a hyperedge replacement grammar. If we store an ordering from the extraction process, the extracted graph grammar is guaranteed to generate an isomorphic copy of the original graph. Or, a stochastic application of the…
▽ More
Discovering the underlying structures present in large real world graphs is a fundamental scientific problem. In this paper we show that a graph's clique tree can be used to extract a hyperedge replacement grammar. If we store an ordering from the extraction process, the extracted graph grammar is guaranteed to generate an isomorphic copy of the original graph. Or, a stochastic application of the graph grammar rules can be used to quickly create random graphs. In experiments on large real world networks, we show that random graphs, generated from extracted graph grammars, exhibit a wide range of properties that are very similar to the original graphs. In addition to graph properties like degree or eigenvector centrality, what a graph "looks like" ultimately depends on small details in local graph substructures that are difficult to define at a global level. We show that our generative graph model is able to preserve these local substructures when generating new graphs and performs well on new and difficult tests of model robustness.
△ Less
Submitted 10 August, 2016;
originally announced August 2016.
-
The Infinity Mirror Test for Analyzing the Robustness of Graph Generators
Authors:
Salvador Aguinaga,
Tim Weninger
Abstract:
Graph generators learn a model from a source graph in order to generate a new graph that has many of the same properties. The learned models each have implicit and explicit biases built in, and its important to understand the assumptions that are made when generating a new graph. Of course, the differences between the new graph and the original graph, as compared by any number of graph properties,…
▽ More
Graph generators learn a model from a source graph in order to generate a new graph that has many of the same properties. The learned models each have implicit and explicit biases built in, and its important to understand the assumptions that are made when generating a new graph. Of course, the differences between the new graph and the original graph, as compared by any number of graph properties, are important indicators of the biases inherent in any modelling task. But these critical differences are subtle and not immediately apparent using standard performance metrics. Therefore, we introduce the infinity mirror test for the analysis of graph generator performance and robustness. This stress test operates by repeatedly, recursively fitting a model to itself. A perfect graph generator would have no deviation from the original or ideal graph, however the implicit biases and assumptions that are cooked into the various models are exaggerated by the infinity mirror test allowing for new insights that were not available before. We show, via hundreds of experiments on 6 real world graphs, that several common graph generators do degenerate in interesting and informative ways. We believe that the observed degenerative patterns are clues to future development of better graph models.
△ Less
Submitted 14 June, 2016;
originally announced June 2016.
