PaperlayerView exact revision on arXiv

Source-linked AI summary

AI-Based Vulnerability Assessment Capability and Cyber Attack Graph Analysis

Joni Herttuainen, Kirsi Hellsten, Vesa Kuikka, Ambrose Kam, Arlanda Johnson, David Welsh, Kimmo K. Kaski

arXiv:2609.35414v1cs.CR

TL;DR

Cybersecurity assessments struggle to cover the combinatorial attack paths in large, mission-critical networks. This paper applies Vortex/Crow and Aalto’s probabilistic attack graphs to the 2015 Ukraine Power Grid incident; both approaches converge on attack vectors and exploit sequences documented in the incident record.

  • Problem

    Reactive point defenses and labor-intensive assessments struggle to cover the combinatorial attack paths of large OT networks facing sophisticated cyber threats.

    Source: §1 · p. 2

  • Method

    The study applies Vortex/Crow’s knowledge-graph and multi-agent reinforcement-learning approach alongside Aalto’s probabilistic attack-graph model to the Ukraine Power Grid scenario.

    Source: §1 · p. 2, §2 · p. 2, §3 · p. 4

  • Results

    Both approaches converged on attack vectors and exploit sequences documented in the 2015 Ukraine Power Grid incident, while CVSS and IronMiner produced similar results.

    Source: §7 · p. 9

  • Takeaways & Limitations

    The authors conclude that both holistic methodologies are useful for predicting attacks in other scenarios or ICS/OT networks, with IronMiner also providing actionable information.

    Source: §7 · p. 9

    A holistic mitigation-prioritization model remains future work to optimize vulnerability mitigation under time, cost, and desired-efficacy constraints.

    Source: §7 · p. 9

Abstract

from arXiv · show

Cyber threats targeting mission-critical infrastructure are becoming more sophisticated while the barrier to launching attacks continues to fall. Traditional point solutions like antivirus and firewalls are reactive and fail to address the combinatorial complexity of modern attack surfaces. This paper presents an investigation combining two complementary methodologies: Lockheed Martin's Vortex/Crow framework, which applies multi-agent reinforcement learning (MARL) over industry-standard cyber knowledge graph to identify and prioritize attack vectors and TTPs (tactics, techniques, and procedures); and Aalto's probabilistic attack graph model that combines network topology and its vulnerabilities to compute system-level risk metrics. The 2015 Ukraine Power Grid cyberattack serves as a well-documented validation scenario. Applied independently to the same operational technology (OT) network topology, both methodologies converge on the same attack vectors and exploit sequences as those documented in the incident record, thus providing mutual cross-validation. Attack graph analyses using node-level elimination experiments identify industrial control systems (ICS) as the most critical enablers of attack propagation, representing high-priority targets for defensive hardening. Comparison of CVSS (v2.0) and IronMiner vulnerability scoring yields in general consistent results, with IronMiner providing more actionable differentiation at network periphery nodes. The layered methodology of baseline assessment and node-level elimination proves to be scalable to large enterprise networks, thus offering defenders a structured, AI-enabled path to prioritize mitigation under realistic time and resource constraints.

1 Introduction

Cyber threats affect critical infrastructure, while conventional point defenses and manual assessments struggle with sophisticated attacks and large, combinatorial attack surfaces. The paper pairs Vortex/Crow and Aalto attack graphs and applies them independently to the 2015 Ukraine Power Grid attack.

1 Introduction

  • Cyber operations can disrupt civilian infrastructure, including power, water, and transportation, with cascading societal and economic consequences.The passage notes that attacks require few resources and that ransomware also targets utilities, hospitals, and transportation networks.Source: §1 · p. 2
  • Traditional reactive defenses and manual attack-surface exercises are difficult to scale across large OT networks and cannot cover the combinatorial space of attack paths.An enterprise OT network may span hundreds or thousands of nodes, each exposing multiple exploitable services.Source: §1 · p. 2
  • The study combines Vortex/Crow’s knowledge-graph and multi-agent reinforcement-learning approach with Aalto’s probabilistic attack graphs to analyze attack sequences and system-level risk.Both approaches were independently applied to reconstruct the 2015 Ukraine Power Grid attack using topology rebuilt from public incident reporting.Source: §1 · p. 2
  • The paper proceeds from Vortex/Crow and attack-graph methods to the Ukraine scenario, analyses, and mitigation prioritization.The planned sections cover combined Vortex/Crow analysis, attack-graph impact estimates, vulnerability-neutralization experiments, and mitigation prioritization.Source: §1 · p. 2

2 ATTACK SURFACE ASSESSMENT WITH VORTEX™/CROW™

Vortex builds a system-specific cyber knowledge graph from configuration and software data, then Crow trains reinforcement-learning agents to compose attack vectors and procedures around specified objectives. The approach automates vulnerability-to-exploit analysis across a broad attack space.

2 ATTACK SURFACE ASSESSMENT WITH VORTEX™/CROW™

  • Vortex builds a customized system knowledge graph by mapping configuration, engineering, software-bill-of-materials, and scanner data to vulnerabilities, weaknesses, attack patterns, and mitigations.The knowledge base is periodically updated and can incorporate additional sources and formats.Source: §2 · p. 2
  • Crow’s multi-agent reinforcement-learning framework composes attack vectors and TTPs to pursue objectives such as 5D effects or the confidentiality-integrity-availability triad.Agents train in a synthetic environment using a reward-bearing objective function; CVE/CWE/CAPEC supply the attack vectors.Source: §2 · p. 2
  • Crow automates vulnerability discovery, exploit mapping, and attack-vector testing, accelerating assessment while covering the combinatorial attack space more comprehensively than manual analysis.The agents are trained over many thousands of episodes, with actions evaluated against the objective function during training.Source: §2 · pp. 2–3

3 Modeling Cybersecurity Defense with Attack Graphs

The attack-graph method represents feasible exploit sequences as probabilistic transitions between software instances and evaluates cumulative impact and propagation risks. Its estimates rely on simplifying assumptions about vulnerabilities, network connectivity, and impact aggregation.

3 Modeling Cybersecurity Defense with Attack Graphs

  • Attack graphs represent feasible, prerequisite-constrained exploit paths, while prior approaches often omit per-service or per-host impact needed for mitigation analysis.The cited prior work includes network-level vulnerability aggregation, dependency-path analysis, and categorized family scores.Source: §3 · pp. 3–4
  • The method models exploit transitions as probabilistic edges derived from vulnerability metrics, authentication structure, and observed attacker capabilities, then evaluates cumulative impact and nodewise, inbound, and outbound risks.The four metrics are CE[I], CNODE, COUT, and CIN; each software instance is treated as a single attack state.Source: §3 · p. 4
  • The model assumes full connectivity across directly connected graph instances because realistic network-link weights are unavailable, making each step’s probability equal to exploitability probability.The exploitability probability aggregates normalized vulnerability scores for the software instance.Source: §3 · p. 4
  • Vulnerability impacts are aggregated by minimum, maximum, and mean within each software instance, and these alternatives feed all four cumulative metrics.The expected impact calculation uses the immediately preceding states.Source: §3 · p. 4
  • For the graph’s cyclic pattern between db_server_1 and engineering_ws_1, cumulative metrics count only the first visit to a software instance and the first entry or exit.This self-avoiding-path treatment differs from the cited methodology’s focus on acyclic graphs.Source: §3 · p. 4
  • The analysis uses CVSS v2.0 exploitability and impact values because it matched the 2015 scenario and many pre-2016 vulnerabilities lack CVSS v3 scores; IronMiner threat scores do not estimate impact.CVSS v2.0 therefore provides both a comparison baseline and the impact estimates required by the graph analysis, while IronMiner contributes vulnerability-risk scores.Source: §3 · pp. 4–5

4 Sample Scenario: 2015 Ukraine Power Grid

The authors reconstruct the 2015 Ukraine Power Grid incident from the CIRT report and map its reported events onto a representative grid architecture. Because the OT configuration was undisclosed, they use a simplified topology with both period-appropriate and more recent components.

4 Sample Scenario: 2015 Ukraine Power Grid

  • The 23 December 2015 outage affected up to 225,000 customers for roughly three hours and was attributed to APT groups using BlackEnergy and related tools against substations.The incident affected three regional distribution companies and was described as the first confirmed power blackout caused by a cyberattack.Source: §4 · p. 5
  • The reported sequence begins with network reconnaissance and enumeration, then access to Active Directory servers containing corporate accounts and credentials.The next reported step used an encrypted tunnel from an external network into control-system networks.Source: §4 · p. 5
  • Attackers accessed SCADA HMIs through an improperly configured firewall, overrode HMI operators to open breakers, and used further actions and KillDisk against control-center systems.The reported KillDisk attempt targeted the control-center HMI and workstations.Source: §4 · p. 5
  • Because the CIRT report did not disclose the OT configuration, the authors reconstructed a simplified topology with 2015-era components on one side and a more recent configuration on the other.The two configurations support evaluating whether Crow agents select incident-comparable attack vectors under legacy and modern assumptions.Source: §4 · p. 5

5 Vortex™/Crow™Analysis

In the reconstructed Ukraine-grid scenario, Vortex supplied vulnerability candidates and IronMiner exploitability scores for Crow’s action space. Crow’s agents learned reward-maximizing sequences, with the highest-probability sequence targeting a node configured similarly to the actual 2015 system.

5 Vortex™/Crow™Analysis

  • IronMiner scored CVE exploitability, while Vortex’s candidate CVEs and CAPECs defined the action and observation spaces Crow’s agents explored.Source: §5 · p. 5
  • The reward prioritized Bypass Protection Mechanism, Gain Privileges, and Execute Unauthorized Commands, with APT44’s MITRE ATT&CK TTPs as prerequisites for agent actions.Source: §5 · p. 5
  • Crow™ agents learned viable attack vectors and optimal sequences emulating APT44; the highest-probability sequence targeted a node configured similarly to the actual 2015 system.A second sequence offered an alternative path against a similar device with different software.Source: §5 · pp. 5–6

6 Attack Graph Analysis

CVSSv2 and IronMiner produce broadly consistent impact results, while IronMiner identifies somewhat higher impacts at several right-side nodes. Node-level elimination highlights simatic_hci_1 and ifix_hci_1 as pivotal points whose vulnerabilities affect downstream attack paths.

6 Attack Graph Analysis

  • CVSSv2 and IronMiner broadly agree on impact rankings, with IronMiner assigning slightly higher impacts to four right-side nodes; both rank simatic_hci_1, db_server_1, and ifix_hci_1 highest.The nodewise results are reported as CNODE per device.Source: §6 · p. 6, Table 1 · p. 8
  • Neutralizing simatic_hci_1 produces the largest overall attack-impact reduction under both scoring systems, followed by ifix_hci_1 and plc_controller_1.Neutralizing db_server_1 or engineering_ws_1 does not affect overall impact because neither lies on a path to the END node.Source: §6 · pp. 7–8
  • Neutralizing simatic_hci_1 or ifix_hci_1 reduces downstream CIN and COUT, while downstream nodes generally yield diminishing reductions and peripheral right-side nodes show no CVSS reduction.IronMiner shows minor reductions for those peripheral nodes.Source: §6 · p. 8

7 Concluding Remarks

The study applies Vortex/Crow and Aalto’s probabilistic attack graph independently to the 2015 Ukraine Power Grid attack scenario. Both approaches converge on the incident’s documented attack vectors and exploit sequences, while mitigation prioritization under resource constraints remains a future challenge.

  • The study combines Vortex/Crow’s knowledge-graph and multi-agent reinforcement-learning framework with Aalto’s probabilistic attack graph to assess OT attack sequences and system-level risk.Source: §7 · p. 8
  • Figure 7 plots expected cumulative impact per software, mapping minimum, mean, and maximum vulnerability-impact values to the box plots’ low end, midline, and high end.Source: Figure 7 · p. 9
  • Both frameworks converged on the attack vectors and exploit sequences documented in the 2015 Ukraine Power Grid incident, providing mutual cross-validation.The study also reports generally similar results from CVSS v2.0 and IronMiner, with IronMiner offering actionable information.Source: §7 · p. 9
  • Choosing mitigations among many possible attack vectors and sequences under time, cost, and desired risk-reduction constraints remains an unresolved challenge.The joint team identifies a holistic mitigation-prioritization model as future work.Source: §7 · p. 9
Loading 2609.35414v1…