Saved in:
| Main Authors: | , |
|---|---|
| Format: | Preprint |
| Published: |
2021
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2106.07160 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866910415301115904 |
|---|---|
| author | Hammar, Kim Stadler, Rolf |
| author_facet | Hammar, Kim Stadler, Rolf |
| contents | We study automated intrusion prevention using reinforcement learning. In a novel approach, we formulate the problem of intrusion prevention as an optimal stopping problem. This formulation allows us insight into the structure of the optimal policies, which turn out to be threshold based. Since the computation of the optimal defender policy using dynamic programming is not feasible for practical cases, we approximate the optimal policy through reinforcement learning in a simulation environment. To define the dynamics of the simulation, we emulate the target infrastructure and collect measurements. Our evaluations show that the learned policies are close to optimal and that they indeed can be expressed using thresholds. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2106_07160 |
| institution | arXiv |
| publishDate | 2021 |
| record_format | arxiv |
| spellingShingle | Learning Intrusion Prevention Policies through Optimal Stopping Hammar, Kim Stadler, Rolf Artificial Intelligence Cryptography and Security Machine Learning Networking and Internet Architecture We study automated intrusion prevention using reinforcement learning. In a novel approach, we formulate the problem of intrusion prevention as an optimal stopping problem. This formulation allows us insight into the structure of the optimal policies, which turn out to be threshold based. Since the computation of the optimal defender policy using dynamic programming is not feasible for practical cases, we approximate the optimal policy through reinforcement learning in a simulation environment. To define the dynamics of the simulation, we emulate the target infrastructure and collect measurements. Our evaluations show that the learned policies are close to optimal and that they indeed can be expressed using thresholds. |
| title | Learning Intrusion Prevention Policies through Optimal Stopping |
| topic | Artificial Intelligence Cryptography and Security Machine Learning Networking and Internet Architecture |
| url | https://arxiv.org/abs/2106.07160 |