# Adaptive Wizard for Removing Cross-Tier Misconfigurations in Active Directory

arXiv: https://arxiv.org/abs/2505.01028 · HTML: https://mlsanity.com/paper/2505.01028/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 11 of its 33 references that are in the map.
- First posted on arXiv 2 May 2025.

## Builds on (most cited first, 11 of 11)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [Soft Actor-Critic for Discrete Action Settings](https://mlsanity.com/paper/1910.07207/) (2019)
- [Deep Reinforcement Learning for Cost-Effective Medical Diagnosis](https://mlsanity.com/paper/2302.10261/) (2023)
- [Approximation Algorithms for Stochastic Boolean Function Evaluation and Stochastic Submodular Set Cover](https://mlsanity.com/paper/1303.0726/) (2013)
- [Practical Fixed-Parameter Algorithms for Defending Active Directory Style Attack Graphs](https://mlsanity.com/paper/2112.13175/) (2021)
- [Defending Active Directory by Combining Neural Network based Dynamic Program and Evolutionary Diversity Optimisation](https://mlsanity.com/paper/2204.03397/) (2022)
- [Scalable Edge Blocking Algorithms for Defending Active Directory Style Attack Graphs](https://mlsanity.com/paper/2212.04326/) (2022)
- [Evolving Reinforcement Learning Environment to Minimize Learner's Achievable Reward: An Application on Hardening Active Directory Systems](https://mlsanity.com/paper/2304.03998/) (2023)
- [Limited Query Graph Connectivity Test](https://mlsanity.com/paper/2302.13036/) (2023)
- [Optimizing Cyber Response Time on Temporal Active Directory Networks Using Decoys](https://mlsanity.com/paper/2403.18162/) (2024)
- [Catch Me if You Can: Effective Honeypot Placement in Dynamic AD Attack Graphs](https://mlsanity.com/paper/2312.16820/) (2023)

## Abstract (arXiv)

Security vulnerabilities in Windows Active Directory (AD) systems are typically modeled using an attack graph and hardening AD systems involves an iterative workflow: security teams propose an edge to remove, and IT operations teams manually review these fixes before implementing the removal. As verification requires significant manual effort, we formulate an Adaptive Path Removal Problem to minimize the number of steps in this iterative removal process. In our model, a wizard proposes an attack path in each step and presents it as a set of multiple-choice options to the IT admin. The IT admin then selects one edge from the proposed set to remove. This process continues until the target t is disconnected from source s or the number of proposed paths reaches B. The model aims to optimize the human effort by minimizing the expected number of interactions between the IT admin and the security wizard. We first prove that the problem is #P-hard. We then propose a set of solutions including an exact algorithm, an approximate algorithm, and several scalable heuristics. Our best heuristic, called DPR, can operate effectively on larger-scale graphs compared to the exact algorithm and consistently outperforms the approximate algorithm across all graphs. We verify the effectiveness of our algorithms on several synthetic AD graphs and an AD attack graph collected from a real organization.