Reinforcement learning improves automated network defense efficiency
A Cyber Range Evaluation of Autonomous Network Incident Response Agents
Cryptography and SecurityArtificial Intelligence
Summary
Protecting computer networks against attacks is hard because defenders must block attackers without disrupting normal users. This paper tests automated agents designed to watch for attacks and respond quickly and smartly. The researchers used a realistic testing environment where attackers and users are simulated. They found that agents trained with reinforcement learning do better at blocking attacks while keeping the network running smoothly compared to simple rule-based agents. How well these agents do depends a lot on the attack methods and regular user activity.
What this means in practice
- •For network security teams: Use learned policies to automate response to network attacks with reduced impact on system users.
- •For cybersecurity training providers: Incorporate autonomous defensive agents in cyber ranges to test and improve human operator skills against dynamic attacks.
Authors
Jakob Nyberg, Teodor Sommestad, Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt
Abstract
We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents. The goal of the defensive agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. Alerts are generated using a SIEM platform and mapped to a data modeling language used by the agents. We test a combination of heuristic agents and policies learned using reinforcement learning. The learned policies are optimized to minimize the combined cost using a cyber attack simulator modeling the network. We found that the reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and that the performance depends highly on the policy of the adversary in combination with the simulated users.