  Reinforcement learning (RL), in conjunction with attack graphs and cyber
terrain, are used to develop reward and state associated with determination of
optimal paths for exfiltration of data in enterprise networks. This work builds
on previous crown jewels (CJ) identification that focused on the target goal of
computing optimal paths that adversaries may traverse toward compromising CJs
or hosts within their proximity. This work inverts the previous CJ approach
based on the assumption that data has been stolen and now must be quietly
exfiltrated from the network. RL is utilized to support the development of a
reward function based on the identification of those paths where adversaries
desire reduced detection. Results demonstrate promising performance for a
sizable network environment.
