# Leveraging Reinforcement Learning in Red Teaming for Advanced Ransomware Attack Simulations

arXiv: https://arxiv.org/abs/2406.17576 · HTML: https://mlsanity.com/paper/2406.17576/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security.
- Builds on 13 of its 28 references that are in the map.
- First posted on arXiv 25 Jun 2024.

## Placed in

- LLM safety and security / [Prompt injection and agent security](https://mlsanity.com/safety/prompt-injection-and-agent-security/)
- Deep reinforcement learning methods / [Adversarial robustness and RL in finance](https://mlsanity.com/deeprl/adversarial-robustness-and-rl-in-finance/)

## Builds on (most cited first, 13 of 13)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [High-Dimensional Continuous Control Using Generalized Advantage Estimation](https://mlsanity.com/paper/1506.02438/) (2015)
- [A Comparison of Static, Dynamic, and Hybrid Analysis for Malware Detection](https://mlsanity.com/paper/2203.09938/) (2022)
- [Using Cyber Terrain in Reinforcement Learning for Penetration Testing](https://mlsanity.com/paper/2108.07124/) (2021)
- [Automated Behavioral Analysis of Malware A Case Study of WannaCry Ransomware](https://mlsanity.com/paper/1709.08753/) (2017)
- [A Survey on Ransomware: Evolution, Taxonomy, and Defense Solutions](https://mlsanity.com/paper/2102.06249/) (2021)
- [Crown Jewels Analysis using Reinforcement Learning with Attack Graphs](https://mlsanity.com/paper/2108.09358/) (2021)
- [Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphs](https://mlsanity.com/paper/2201.12416/) (2022)
- [Exposing Surveillance Detection Routes via Reinforcement Learning, Attack Graphs, and Cyber Terrain](https://mlsanity.com/paper/2211.03027/) (2022)
- [Discovering Command and Control Channels Using Reinforcement Learning](https://mlsanity.com/paper/2401.07154/) (2024)
- [Ransomware Detection Using Deep Learning in the SCADA System of Electric Vehicle Charging Station](https://mlsanity.com/paper/2104.07409/) (2021)
- [Peeler: Profiling Kernel-Level Events to Detect Ransomware](https://mlsanity.com/paper/2101.12434/) (2021)
- [Enhancing Exfiltration Path Analysis Using Reinforcement Learning](https://mlsanity.com/paper/2310.03667/) (2023)

## Built on by (most cited first, 1 of 1)

- [From Capabilities to Performance: Evaluating Key Functional Properties of LLM Architectures in Penetration Testing](https://mlsanity.com/paper/2509.14289/) (2025)

## Abstract (arXiv)

Ransomware presents a significant and increasing threat to individuals and organizations by encrypting their systems and not releasing them until a large fee has been extracted. To bolster preparedness against potential attacks, organizations commonly conduct red teaming exercises, which involve simulated attacks to assess existing security measures. This paper proposes a novel approach utilizing reinforcement learning (RL) to simulate ransomware attacks. By training an RL agent in a simulated environment mirroring real-world networks, effective attack strategies can be learned quickly, significantly streamlining traditional, manual penetration testing processes. The attack pathways revealed by the RL agent can provide valuable insights to the defense team, helping them identify network weak points and develop more resilient defensive measures. Experimental results on a 152-host example network confirm the effectiveness of the proposed approach, demonstrating the RL agent's capability to discover and orchestrate attacks on high-value targets while evading honeyfiles (decoy files strategically placed to detect unauthorized access).