Attack Path Discovery for Industrial Control System Based on Knowledge-Enhanced Attack Graphs and Causal-Aware Reinforcement Learning

Abstract

Attack path discovery is essential for enhancing the security of industrial control systems (ICS). Existing methods combining attack graphs and machine learning have shown promising performance, but remain limited by incomplete attack knowledge, high computational complexity and inefficient exploration of valid attack paths. To address these issues, we propose an attack path discovery method based on knowledge -enhanced attack graphs and causal-aware reinforcement learning (RL). First, a knowledge-driven attack graph construction method is proposed by leveraging the MITRE ATT&CK for ICS matrix to generate diverse attack templates and improve the coverage of potential attack paths. Meanwhile, an aggregation method for adjacent and multi-head information is proposed for the graph embedding to reduce computational complexity. Furthermore, causal graphs are incorporated to guide weight assignment and policy update, thereby improving the efficiency of discovering valid paths. Experiments conducted on a fluid catalytic cracking simulation platform and two public datasets show that the proposed method increases the number of discovered attack paths by 6.65%, 15.50%, and 11.80%, respectively, compared with the other methods.