{"type":"ScholarlyArticle","title":"Practical Anytime Algorithms for Judicious Partitioning of Active Directory Attack Graphs","authors":[{"name":"Yumeng Zhang","slug":"yumeng-zhang","given":"Yumeng","family":"Zhang","affiliation":"The University of Adelaide"},{"name":"Max Ward","slug":"max-ward","given":"Max","family":"Ward","affiliation":"University of Western Australia"},{"name":"Hung Nguyen","slug":"hung-nguyen","given":"Hung","family":"Nguyen","affiliation":"The University of Adelaide"}],"abstract":"Given a directed graph, a set of source nodes, a target node and a budget, we study the problem of maximizing the number of source nodes disconnected from the target node by removing edges not exceeding the budget. Our model is mainly motivated by a cyber security use case where we need to minimize the attack surface of a Windows Active Directory system. In these high-profile attacks, the attackers first compromise a source (i.e., a compromised user node) and then laterally move to a destination (i.e., a high-privileged admin node). Our aim is to minimize the number of users with a path to the admin.\r\n\r\nWe first prove that the problem is NP-hard. Algorithms for exact optimality usually struggle to converge on graphs that approach real-world network scales and therefore are not practical for usage. In light of this, we study anytime algorithms that return an acceptable result whenever the algorithm is terminated, and can improve optimality by allowing longer computational time. We observe the source connectivity of directed graphs, based on which we propose a novel anytime algorithm---the spiral algorithm. We also develop two Monte Carlo Tree Search (MCTS) algorithms as a baseline to study the performance of typical anytime algorithms for our problem, and show that the spiral algorithm improves the optimality at a significantly faster speed and therefore exhibits better anytime behavior compared with MCTS.","doi":"10.24963/ijcai.2024/782","url":"https://ijcai.org/proceedings/2024/782","pdf":"https://ijcai.org/proceedings/2024/0782.pdf","markdown":"https://ijcai.org/proceedings/2024/782.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/782","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"Search","track":"Main Track","number":782,"pages":{"first":7074,"last":7081},"keywords":["Multidisciplinary Topics and Applications: MTA: Security and privacy","Search: S: Combinatorial search and optimisation"],"videos":[],"references":[{"position":1,"raw":"[Auer et al., 2002] Peter Auer, Nicolo Cesa-Bianchi, and Paul Fischer. Finite-time analysis of the multiarmed bandit problem. Machine learning, 47:235-256, 2002.","title":"Finite-time analysis of the multiarmed bandit problem","authors":"Auer","year":"2002","venue":"Machine learning","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Barik et al., 2016] Mridul Sankar Barik, Anirban Sengupta, and Chandan Mazumdar. Attack graph generation and analysis techniques. Defence science journal, 66(6):559, 2016.","title":"Attack graph generation and analysis techniques","authors":"Mridul Sankar Barik, Anirban Sengupta, Chandan Mazumdar","year":"2016","venue":"Defence science journal","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Bollobás and Scott, 2002] Béla Bollobás and Alex D Scott. Problems and results on judicious partitions. Random Structures & Algorithms, 21(3-4):414-430, 2002.","title":"Problems and results on judicious partitions","authors":"Scott ; Bollobás, Béla Bollobás, Alex D Scott","year":"2002","venue":"Random Structures & Algorithms","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Bollobás and Scott, 2004] Béla Bollobás and Alex D Scott. Judicious partitions of bounded-degree graphs. Journal of Graph Theory, 46(2):131-143, 2004.","title":"Judicious partitions of bounded-degree graphs","authors":"Scott ; Bollobás, Béla Bollobás, Alex D Scott","year":"2004","venue":"Journal of Graph Theory","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Bouillot and Gras, 2014] Lucas Bouillot and Emmanuel Gras. Chemins de contrôle en environnement active di- rectory. Proceedings of the SSTIC conférence 2014, 2014.","title":"Chemins de contrôle en environnement active directory","authors":"Lucas Bouillot, Emmanuel Gras","year":"2014","venue":"Proceedings of the SSTIC conférence 2014","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Corneil and Perl, 1984] Derek G Corneil and Yehoshua Perl. Clustering and domination in perfect graphs. Dis- crete Applied Mathematics, 9(1):27-39, 1984.","title":"Clustering and domination in perfect graphs","authors":"G Derek, Yehoshua Corneil, Perl","year":"1984","venue":"Discrete Applied Mathematics","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dunagan et al., 2009] John Dunagan, Alice X Zheng, and Daniel R Simon. Heat-ray: combating identity snow- ball attacks using machinelearning, combinatorial opti- mization and attack graphs. In Proceedings of the ACM SIGOPS 22nd symposium on Operating systems princi- ples, pages 305-320, 2009.","title":"Heat-ray: combating identity snowball attacks using machinelearning, combinatorial optimization and attack graphs","authors":"John Dunagan, Alice X Zheng, Daniel R Simon","year":"2009","venue":"Proceedings of the ACM SIGOPS 22nd symposium on Operating systems principles","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Fjällström, 1998] Per-Olof Fjällström. Algorithms for graph partitioning: A survey. Linköping University Elec- tronic Press, 1998.","title":"Per-Olof Fjällström. Algorithms for graph partitioning: A survey","authors":"Fjällström","year":"1998","venue":null,"doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Garey et al., 1976] M.R. Garey, D.S. Johnson, and L. Stockmeyer. Some simplified np-complete graph problems. Theoretical Computer Science, 1(3):237-267, 1976.","title":"Some simplified np-complete graph problems","authors":"M R Garey, D S Johnson, L Stockmeyer","year":"1976","venue":"Theoretical Computer Science","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Guo et al., 2022] Mingyu Guo, Jialiang Li, Aneta Neu- mann, Frank Neumann, and Hung Nguyen. Practical fixed-parameter algorithms for defending active directory style attack graphs. In Proceedings of the AAAI Confer- ence on Artificial Intelligence, volume 36, pages 9360- 9367, 2022.","title":"Practical fixed-parameter algorithms for defending active directory style attack graphs","authors":"Mingyu Guo, Jialiang Li, Aneta Neumann, Frank Neumann, Hung Nguyen","year":"2022","venue":"Proceedings of the AAAI Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[Guo et al., 2023] Mingyu Guo, Max Ward, Aneta Neu- mann, Frank Neumann, and Hung Nguyen. Scalable edge blocking algorithms for defending active directory style at- tack graphs. In Proceedings of the AAAI Conference on Ar- tificial Intelligence, volume 37, pages 5649-5656, 2023.","title":"Scalable edge blocking algorithms for defending active directory style attack graphs","authors":"Mingyu Guo, Max Ward, Aneta Neumann, Frank Neumann, Hung Nguyen","year":"2023","venue":"Proceedings of the AAAI Conference on Artificial Intelligence","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[Korte and Vygen, 2012] Bernhard Korte and Jens Vygen. Network flows. Combinatorial Optimization: Theory and Algorithms, pages 173-209, 2012.","title":"Network flows","authors":"Bernhard Korte, Jens Vygen","year":"2012","venue":"Combinatorial Optimization: Theory and Algorithms","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Krishnamoorthi and Carleton, 2020] Swetha Krishnamoor- thi and Jarad Carleton. Active directory holds the keys to your kingdom, but is it secure? https://www.frost.com/ frost-perspectives/active-directory-holds-the-keys-to-you r-kingdom-but-is-it-secure/, 2020.","title":"Swetha Krishnamoorthi and Jarad Carleton. Active directory holds the keys to your kingdom, but is it secure","authors":"Carleton Krishnamoorthi","year":"2020","venue":null,"doi":null,"url":"https://www.frost.com/frost-perspectives/active-directory-holds-the-keys-to-your-kingdom-but-is-it-secure/,2020","internal_url":null},{"position":14,"raw":"[Lallie et al., 2020] Harjinder Singh Lallie, Kurt Debattista, and Jay Bal. A review of attack graph and attack tree vi- sual syntax in cyber security. Computer Science Review, 35:100219, 2020.","title":"A review of attack graph and attack tree visual syntax in cyber security","authors":"Harjinder Singh Lallie, Kurt Debattista, Jay Bal","year":"2020","venue":"Computer Science Review","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Lee et al., 2016] Choongbum Lee, Po-Shen Loh, and Benny Sudakov. Judicious partitions of directed graphs. Random Structures & Algorithms, 48(1):147-170, 2016.","title":"Judicious partitions of directed graphs","authors":"Lee","year":"2016","venue":"Random Structures & Algorithms","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Ngo et al., 2024] Huy Quang Ngo, Mingyu Guo, and Hung Nguyen. Catch me if you can: Effective honeypot place- ment in dynamic ad attack graphs. in Procs. of the IEEE Infocom, 2024, 2024.","title":"Catch me if you can: Effective honeypot placement in dynamic ad attack graphs","authors":"Quang Huy, Mingyu Ngo, Hung Guo, Nguyen","year":"2024","venue":"Procs. of the IEEE Infocom","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Ortalo et al., 1999] Rodolphe Ortalo, Yves Deswarte, and Mohamed Kaâniche. Experimenting with quantitative evaluation tools for monitoring operational security. IEEE Transactions on Software Engineering, 25(5):633-650, 1999.","title":"Experimenting with quantitative evaluation tools for monitoring operational security","authors":"Ortalo","year":"1999","venue":"IEEE Transactions on Software Engineering","doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Ou et al., 2006] Xinming Ou, Wayne F. Boyer, and Miles A. McQueen. A scalable approach to attack graph generation. In Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS '06, page 336-345, New York, NY, USA, 2006. Association for Computing Machinery.","title":"A scalable approach to attack graph generation","authors":"Xinming Ou, Wayne F Boyer, Miles A Mcqueen","year":"2006","venue":"Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS '06","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Phillips and Swiler, 1998] Cynthia Phillips and Laura Painton Swiler. A graph-based system for network-vulnerability analysis. In Proceedings of the 1998 Workshop on New Security Paradigms, NSPW '98, page 71-79, New York, NY, USA, 1998. Association for Computing Machinery.","title":"A graph-based system for network-vulnerability analysis","authors":"Cynthia Phillips, Laura Painton Swiler","year":"1998","venue":"Proceedings of the 1998 Workshop on New Security Paradigms, NSPW '98","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Ritchey and Ammann, 2000] Ronald W Ritchey and Paul Ammann. Using model checking to analyze network vul- nerabilities. In Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000, pages 156-165. IEEE, 2000.","title":"Using model checking to analyze network vulnerabilities","authors":"W Ronald, Paul Ritchey, Ammann","year":"2000","venue":"Proceeding 2000 IEEE Symposium on Security and Privacy. S&P 2000","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Robbins et al., 2016] Andy Robbins, Rohan Vazarkar, and Will Schroeder. Bloodhound: Six degrees of domain ad- min. https://bloodhound.readthedocs.io/en/latest/index.ht ml, 2016. Accessed: 2022-12-14.","title":"Bloodhound: Six degrees of domain admin","authors":"Robbins","year":"2016","venue":null,"doi":null,"url":"https://bloodhound.readthedocs.io/en/latest/index.html,2016","internal_url":null},{"position":22,"raw":"[Schneier, 1999] Bruce Schneier. Attack trees. Dr. Dobb's journal, 24(12):21-29, 1999.","title":"Attack trees. Dr","authors":"Bruce Schneier","year":"1999","venue":"Dobb's journal","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Scott, 2005] Alexander D Scott. Judicious partitions and re- lated problems. In BCC, pages 95-117, 2005.","title":"Judicious partitions and related problems","authors":"D Alexander, Scott","year":"2005","venue":"BCC","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Sheyner et al., 2002] Oleg Sheyner, Joshua Haines, Somesh Jha, Richard Lippmann, and Jeannette M Wing. Auto- mated generation and analysis of attack graphs. In Pro- ceedings 2002 IEEE Symposium on Security and Privacy, pages 273-284. IEEE, 2002.","title":"Automated generation and analysis of attack graphs","authors":"Oleg Sheyner, Joshua Haines, Somesh Jha, Richard Lippmann, Jeannette M Wing","year":"2002","venue":"Proceedings 2002 IEEE Symposium on Security and Privacy","doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Tholey, 2006] Torsten Tholey. Solving the 2-disjoint paths problem in nearly linear time. Theory of computing sys- tems, 39(1):51-78, 2006.","title":"Solving the 2-disjoint paths problem in nearly linear time","authors":"Torsten Tholey, Tholey","year":"2006","venue":"Theory of computing systems","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Wood, 1993] R Kevin Wood. Deterministic network inter- diction. Mathematical and Computer Modelling, 17(2):1- 18, 1993.","title":"Deterministic network interdiction","authors":"Kevin Wood","year":"1993","venue":"Mathematical and Computer Modelling","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Zhang et al., 2023] Yumeng Zhang, Max Ward, Mingyu Guo, and Hung Nguyen. A scalable double oracle al- gorithm for hardening large active directory systems. In Proceedings of the 2023 ACM Asia Conference on Com- puter and Communications Security, ASIA CCS '23, page 993-1003, New York, NY, USA, 2023. Association for Computing Machinery.","title":"A scalable double oracle algorithm for hardening large active directory systems","authors":"Zhang","year":"2023","venue":"Proceedings of the 2023 ACM Asia Conference on Computer and Communications Security, ASIA CCS '23","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}