  Microsoft Active Directory (AD) is the default security management system for
Window domain network. We study the problem of placing decoys in AD network to
detect potential attacks. We model the problem as a Stackelberg game between an
attacker and a defender on AD attack graphs where the defender employs a set of
decoys to detect the attacker on their way to Domain Admin (DA). Contrary to
previous works, we consider time-varying (temporal) attack graphs. We proposed
a novel metric called response time, to measure the effectiveness of our decoy
placement in temporal attack graphs. Response time is defined as the duration
from the moment attackers trigger the first decoy to when they compromise the
DA. Our goal is to maximize the defender's response time to the worst-case
attack paths. We establish the NP-hard nature of the defender's optimization
problem, leading us to develop Evolutionary Diversity Optimization (EDO)
algorithms. EDO algorithms identify diverse sets of high-quality solutions for
the optimization problem. Despite the polynomial nature of the fitness
function, it proves experimentally slow for larger graphs. To enhance
scalability, we proposed an algorithm that exploits the static nature of AD
infrastructure in the temporal setting. Then, we introduce tailored repair
operations, ensuring the convergence to better results while maintaining
scalability for larger graphs.
