Attack Path Planning Using Proximal Policy Optimization Reinforcement Learning Bidirectional Ant Colony Optimization (PPO-BACO) Algorithm and Cyber Threat Knowledge Graph in Air Traffic Management System

With the development of the Air Traffic Management (ATM) system, cyber attacks in ATM are on the rise, and the level of automation and correlation are increasing. Traditional penetration testing attack path planning relies on domain specific expert experience, which can consume significant manpower and time resources for large scale networks. Additionally, there is a significant fragmentation of valuable security information such as vulnerability databases, cyber security reports, and cyber threat intelligence repositories that remain underutilized. This paper proposes a novel ATM cyber threat knowledge graph (ATMCyKG), based on the attack tactics, techniques, and procedures (TTP) templates provided by ATT&CK and built using Neo4j. This paper introduces an attack path planning method based on Proximal Policy Optimization Bidirectional Ant Colony Optimization (PPO-BACO) that addresses the initial stage challenges of classic ant colony algorithms: lack of ant guidance leading to low path quality, affecting pheromone distribution, and causing ants to easily fall into local optima. Moreover, traditional ant colony algorithms perform unidirectional searches, resulting in slow search speeds and low algorithm efficiency. Leveraging node information from ATM cyber threat knowledge graph, this paper introduces a bidirectional ant colony algorithm, integrating proximal policy optimization, bidirectional ant search strategy, path crossover optimization operation, and optimization strategy for pheromone update methods to better suit the attack path planning. The algorithm is experimentally validated, compared with other algorithms, comprehensively analyzed, and summarized. Attack paths can uncover potential cyber attacks behaviors, enhance the cyber security defense capabilities of ATM, and better ensure the safety of air transportation.