Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys

Huy Q. Ngo, Mingyu Guo, Hung Nguyen

TL;DR

This work model the problem of placing decoys in AD network as a Stackelberg game between an attacker and a defender on AD attack graphs where the defender employs a set of decoys to detect the attacker on their way to Domain Admin (DA).

Abstract

Microsoft Active Directory (AD) is the default security management system for Window domain network. We study the problem of placing decoys in AD network to detect potential attacks. We model the problem as a Stackelberg game between an attacker and a defender on AD attack graphs where the defender employs a set of decoys to detect the attacker on their way to Domain Admin (DA). Contrary to previous works, we consider time-varying (temporal) attack graphs. We proposed a novel metric called response time, to measure the effectiveness of our decoy placement in temporal attack graphs. Response time is defined as the duration from the moment attackers trigger the first decoy to when they compromise the DA. Our goal is to maximize the defender's response time to the worst-case attack paths. We establish the NP-hard nature of the defender's optimization problem, leading us to develop Evolutionary Diversity Optimization (EDO) algorithms. EDO algorithms identify diverse sets of high-quality solutions for the optimization problem. Despite the polynomial nature of the fitness function, it proves experimentally slow for larger graphs. To enhance scalability, we proposed an algorithm that exploits the static nature of AD infrastructure in the temporal setting. Then, we introduce tailored repair operations, ensuring the convergence to better results while maintaining scalability for larger graphs.

Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys

TL;DR

This work model the problem of placing decoys in AD network as a Stackelberg game between an attacker and a defender on AD attack graphs where the defender employs a set of decoys to detect the attacker on their way to Domain Admin (DA).

Abstract

Microsoft Active Directory (AD) is the default security management system for Window domain network. We study the problem of placing decoys in AD network to detect potential attacks. We model the problem as a Stackelberg game between an attacker and a defender on AD attack graphs where the defender employs a set of decoys to detect the attacker on their way to Domain Admin (DA). Contrary to previous works, we consider time-varying (temporal) attack graphs. We proposed a novel metric called response time, to measure the effectiveness of our decoy placement in temporal attack graphs. Response time is defined as the duration from the moment attackers trigger the first decoy to when they compromise the DA. Our goal is to maximize the defender's response time to the worst-case attack paths. We establish the NP-hard nature of the defender's optimization problem, leading us to develop Evolutionary Diversity Optimization (EDO) algorithms. EDO algorithms identify diverse sets of high-quality solutions for the optimization problem. Despite the polynomial nature of the fitness function, it proves experimentally slow for larger graphs. To enhance scalability, we proposed an algorithm that exploits the static nature of AD infrastructure in the temporal setting. Then, we introduce tailored repair operations, ensuring the convergence to better results while maintaining scalability for larger graphs.
Paper Structure (24 sections, 5 theorems, 5 equations, 3 figures, 2 tables, 5 algorithms)

This paper contains 24 sections, 5 theorems, 5 equations, 3 figures, 2 tables, 5 algorithms.

Table of Contents

  1. Introduction
  2. Model Description
  3. Background
  4. Problem formulation
  5. Related Work
  6. Proposed methodology
  7. Game-theoretical rational attacker
  8. Faster computation for earliest-arrival path
  9. EDO Algorithm for max-$RT$
  10. Constraint-Handling Evolutionary Algorithm
  11. Integer Programming repair operator
  12. Surrogate-assisted and penalty-based repair operator
  13. Experiment Result
  14. Experiment Set Up
  15. Result Interpretation
  16. ...and 9 more sections

Key Result

Theorem 1

Defender's problem is $\mathcal{NP}$-hard.

Figures (3)

  • Figure 1: Example of an Active Directory graph sampled over a period of 10 time units. The timestamps on each edge indicates its appearance time. Black labels represent static edges, while orange labels denote dynamic edges (HasSession).
  • Figure 2: Performance comparison of all 6 algorithms. The EST approaches exhibit significantly faster convergence to the best result compared to the other methods.
  • Figure 3: Proof gadget for Theorem \ref{['theorem:np']}. a) Proof gadget for Strict-TS problem. b) Proof gadget for max-$RT$ problem

Theorems & Definitions (10)

  • Theorem 1
  • Theorem 2
  • Theorem 3
  • Theorem 4
  • proof
  • proof
  • Lemma 5
  • proof
  • proof
  • proof