Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
Ransomware presents a significant and increasing threat to individuals and organizations by encrypting their systems and not releasing them until a large fee has been extracted. To bolster preparedness against potential attacks, organizations commonly conduct red teaming exercises, which involve simulated attacks to assess existing security measures. This paper proposes a novel approach utilizing reinforcement learning (RL) to simulate ransomware attacks. By training an RL agent in a simulated environment mirroring real-world networks, effective attack strategies can be learned quickly, significantly streamlining traditional, manual penetration testing processes. The attack pathways revealed by the RL agent can provide valuable insights to the defense team, helping them identify network weak points and develop more resilient defensive measures. Experimental results on a 152-host example network confirm the effectiveness of the proposed approach, demonstrating the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files strategically placed to detect unauthorized access).
Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 13 of its 28 references that are in the map. First posted on arXiv 25 Jun 2024.
Builds on
13 of 28 references.
References · 13
- 2017Proximal Policy Optimization Algorithmscited by 14,441
- 2015High-Dimensional Continuous Control Using Generalized Advantage Estimationcited by 1,916
- 2021Using Cyber Terrain in Reinforcement Learning for Penetration Testingcited by 16
- 2022A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detectioncited by 16
- 2017Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomwarecited by 9
- 2021A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutionscited by 9
- 2021Crown Jewels Analysis using Reinforcement Learning with Attack Graphscited by 8
- 2022Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphscited by 8
- 2022Exposing Surveillance Detection Routes via Reinforcement Learning, Attack Graphs, and Cyber Terraincited by 3
- 2024Discovering Command and Control Channels Using Reinforcement Learningcited by 3
- 2021Ransomware Detection Using Deep Learning in the SCADA System of Electric Vehicle Charging Stationcited by 2
- 2021Peeler: Profiling Kernel-Level Events to Detect Ransomwarecited by 1
1 more
Built on by
Citing papers per year: 2025: 1.
1 paper.