Learning Near-Optimal Intrusion Responses Against Dynamic Attackers
arXiv:2301.06085 · doi:10.1109/TNSM.2023.3293413
Abstract
We study automated intrusion response and formulate the interaction between an attacker and a defender as an optimal stopping game where attack and defense strategies evolve through reinforcement learning and self-play. The game-theoretic modeling enables us to find defender strategies that are effective against a dynamic attacker, i.e. an attacker that adapts its strategy in response to the defender strategy. Further, the optimal stopping formulation allows us to prove that optimal strategies have threshold properties. To obtain near-optimal defender strategies, we develop Threshold Fictitious Self-Play (T-FP), a fictitious self-play algorithm that learns Nash equilibria through stochastic approximation. We show that T-FP outperforms a state-of-the-art algorithm for our use case. The experimental part of this investigation includes two systems: a simulation system where defender strategies are incrementally learned and an emulation system where statistics are collected that drive simulation runs and where learned strategies are evaluated. We argue that this approach can produce effective defender strategies for a practical IT infrastructure.
arXiv admin note: substantial text overlap with arXiv:2205.14694
References in corpus (10)
- Reinforcement Learning for IoT Security: A Comprehensive Survey
- Network Environment Design for Autonomous Cyberdefense
- Prospective Artificial Intelligence Approaches for Active Cyber Defence
- Deep hierarchical reinforcement agents for automated penetration testing
- Multi-agent Reinforcement Learning in Bayesian Stackelberg Markov Games for Adaptive Moving Target Defense
- CyGIL: A Cyber Gym for Training Autonomous Agents over Emulated Network Systems
- Beyond CAGE: Investigating Generalization of Learned Autonomous Network Defense Policies
- Constraints Satisfiability Driven Reinforcement Learning for Autonomous Cyber Defense
- Multiple Domain Cyberspace Attack and Defense Game Based on Reward Randomization Reinforcement Learning
- A System for Interactive Examination of Learned Security Policies