AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis
Two AI attack-graph methods recover the 2015 Ukraine grid paths and flag ICS nodes.
The paper combines Lockheed Martin's Vortex/Crow multi-agent reinforcement learning over a cyber knowledge graph with Aalto's probabilistic attack-graph model based on topology and vulnerabilities. Applied independently to the same operational-technology network, both reproduce the attack vectors and exploit sequences documented in the 2015 Ukraine power-grid incident. Node-elimination experiments identify industrial control systems as the main propagation enablers, while IronMiner scoring generally agrees with CVSS v2.0 and differentiates periphery nodes more clearly.
- Vortex/Crow uses multi-agent RL to prioritize attack vectors.
- Both methods match the documented 2015 Ukraine grid sequences.
- ICS nodes are the main enablers of attack propagation.
- IronMiner generally agrees with CVSS v2.0 scoring.
- Vendors
- Lockheed Martin
- Products
- Vortex/CrowIronMiner
- Victims
- Ukraine power grid
- Organizations
- Aalto University
- Countries
- Ukraine
From the original article
1 min read at arxiv.orgCyber threats targeting mission-critical infrastructure are becoming more sophisticated while the barrier to launching attacks continues to fall. Traditional point solutions like antivirus and firewalls are reactive and fail to address the combinatorial complexity of modern attack surfaces.
By Joni Herttuainen · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.