Adaptive Wizard for Removing Cross-Tier Misconfigurations in Active Directory

• URL: http://arxiv.org/abs/2505.01028v1
• Date: Fri, 02 May 2025 05:55:56 GMT
• Title: Adaptive Wizard for Removing Cross-Tier Misconfigurations in Active Directory
• Abstract summary: Security vulnerabilities in Windows Active Directory (AD) systems are typically modeled using an attack graph and hardening AD systems involves an iterative workflow.<n>We formulate an Adaptive Path Removal Problem to minimize the number of steps in this iterative removal process.<n>Our best, called DPR, can operate effectively on larger-scale graphs compared to the exact algorithm and consistently outperforms the approximate algorithm across all graphs.
• Score: 4.2671394819888455
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Security vulnerabilities in Windows Active Directory (AD) systems are typically modeled using an attack graph and hardening AD systems involves an iterative workflow: security teams propose an edge to remove, and IT operations teams manually review these fixes before implementing the removal. As verification requires significant manual effort, we formulate an Adaptive Path Removal Problem to minimize the number of steps in this iterative removal process. In our model, a wizard proposes an attack path in each step and presents it as a set of multiple-choice options to the IT admin. The IT admin then selects one edge from the proposed set to remove. This process continues until the target $t$ is disconnected from source $s$ or the number of proposed paths reaches $B$. The model aims to optimize the human effort by minimizing the expected number of interactions between the IT admin and the security wizard. We first prove that the problem is $\mathcal{\#P}$-hard. We then propose a set of solutions including an exact algorithm, an approximate algorithm, and several scalable heuristics. Our best heuristic, called DPR, can operate effectively on larger-scale graphs compared to the exact algorithm and consistently outperforms the approximate algorithm across all graphs. We verify the effectiveness of our algorithms on several synthetic AD graphs and an AD attack graph collected from a real organization.

Related papers

• Practical Graph Optimisation and AI-Driven Models for Active Directory Security Hardening [0.0]
  This thesis studies and proposes a number of game-theoretic and optimisation-based decision-making models.<n>First, we propose a honeypot/decoy placement model based on the principle of minimising the number of shortest paths.<n>Second, building on this model, we introduce a defence strategy that considers the dynamic/temporal nature of the AD graph.<n>Third, we introduce an adaptive prioritisation model that queries each high-risk attack path to the IT administrator for mediation.
  arXiv  Detail & Related papers  (2026-07-24T06:14:59Z)
• Provably Optimal Learning Algorithms for Assistance Games [60.843021846414956]
  We provide the first provably efficient learning algorithms for repeated assistance games.<n>We present decentralized algorithms for both an informed human and the assistant.<n>We prove that achieving a regret approximation factor better than $(1-1/e)$ is computationally intractable.
  arXiv  Detail & Related papers  (2026-07-09T00:38:42Z)
• Budget-Efficient Automatic Algorithm Design via Code Graph [2.982218441172364]
  Large language models (LLMs) have emerged as powerful tools for automatic algorithm design (AAD)<n>We formalize budget-efficient automatic algorithm design, wherein the search policy maximizes realized fitness subject to limited computational cost.<n>We validate our method empirically on three optimization problems, demonstrating consistent superiority of our graph-based search over full-algorithm search at equal token budget.
  arXiv  Detail & Related papers  (2026-05-11T14:01:52Z)
• Process Supervision for Chain-of-Thought Reasoning via Monte Carlo Net Information Gain [23.290482237410398]
  Multi-step reasoning improves the capabilities of large language models (LLMs) but increases the risk of errors propagating through intermediate steps.<n>Process reward models (PRMs) mitigate this by scoring each step individually, enabling fine-grained supervision and improved reliability.<n>We propose a novel approach to automatically generate step-level labels using Information Theory.
  arXiv  Detail & Related papers  (2026-03-18T15:08:01Z)
• Near-Optimal Online Learning for Multi-Agent Submodular Coordination: Tight Approximation and Communication Efficiency [52.60557300927007]
  We present a $textbfMA-OSMA$ algorithm to transfer the discrete submodular problem into a continuous optimization.<n>We also introduce a projection-free $textbfMA-OSEA$ algorithm, which effectively utilizes the KL divergence by mixing a uniform distribution.<n>Our algorithms significantly improve the $(frac11+c)$-approximation provided by the state-of-the-art OSG algorithm.
  arXiv  Detail & Related papers  (2025-02-07T15:57:56Z)
• Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys [4.2671394819888455]
  We study the problem of placing decoys in Microsoft Active Directory (AD) network to detect potential attacks. We propose a novel metric called response time, to measure the effectiveness of our decoy placement in temporal attack graphs. Our goal is to maximize the defender's response time to the worst-case attack paths.
  arXiv  Detail & Related papers  (2024-03-27T00:05:48Z)
• FAMO: Fast Adaptive Multitask Optimization [48.59232177073481]
  We introduce Fast Adaptive Multitask Optimization FAMO, a dynamic weighting method that decreases task losses in a balanced way. Our results indicate that FAMO achieves comparable or superior performance to state-of-the-art gradient manipulation techniques.
  arXiv  Detail & Related papers  (2023-06-06T15:39:54Z)
• Communication-Efficient Adam-Type Algorithms for Distributed Data Mining [93.50424502011626]
  We propose a class of novel distributed Adam-type algorithms (emphi.e., SketchedAMSGrad) utilizing sketching. Our new algorithm achieves a fast convergence rate of $O(frac1sqrtnT + frac1(k/d)2 T)$ with the communication cost of $O(k log(d))$ at each iteration.
  arXiv  Detail & Related papers  (2022-10-14T01:42:05Z)
• Large-scale Optimization of Partial AUC in a Range of False Positive Rates [51.12047280149546]
  The area under the ROC curve (AUC) is one of the most widely used performance measures for classification models in machine learning. We develop an efficient approximated gradient descent method based on recent practical envelope smoothing technique. Our proposed algorithm can also be used to minimize the sum of some ranked range loss, which also lacks efficient solvers.
  arXiv  Detail & Related papers  (2022-03-03T03:46:18Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)
• Minimax Optimization with Smooth Algorithmic Adversaries [59.47122537182611]
  We propose a new algorithm for the min-player against smooth algorithms deployed by an adversary. Our algorithm is guaranteed to make monotonic progress having no limit cycles, and to find an appropriate number of gradient ascents.
  arXiv  Detail & Related papers  (2021-06-02T22:03:36Z)
• Multiagent Rollout and Policy Iteration for POMDP with Application to Multi-Robot Repair Problems [1.6939372704265414]
  We consider infinite horizon discounted dynamic programming problems with finite state and control spaces, partial state observations, and a multiagent structure. Our methods specifically address the computational challenges of partially observable multiagent problems.
  arXiv  Detail & Related papers  (2020-11-09T06:51:50Z)
• Fast Learning for Renewal Optimization in Online Task Scheduling [18.935043109084543]
  This paper considers online optimization of a renewal-reward system. The probability distribution for the task type vector is unknown. The proposed algorithm uses an auxiliary variable that is updated according to a classic Robbins-Monro iteration.
  arXiv  Detail & Related papers  (2020-07-18T22:44:13Z)
• CNN Encoder to Reduce the Dimensionality of Data Image for Motion Planning [1.244705780038575]
  We propose a CNN encoder capable of eliminating useless routes for motion planning problems. In all evaluated scenarios, our solution reduced the number of iterations by more than 60%.
  arXiv  Detail & Related papers  (2020-04-10T15:44:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.