Current browse context:
cs.LG
Change to browse by:
References & Citations
Computer Science > Machine Learning
Title: Intrusion Prevention through Optimal Stopping
(Submitted on 30 Oct 2021 (v1), revised 17 Feb 2022 (this version, v6), latest version 1 Apr 2022 (v7))
Abstract: We study automated intrusion prevention using reinforcement learning. Following a novel approach, we formulate the problem of intrusion prevention as an (optimal) multiple stopping problem. This formulation gives us insight into the structure of optimal policies, which we show to have threshold properties. For most practical cases, it is not feasible to obtain an optimal defender policy using dynamic programming. We therefore develop a reinforcement learning approach to approximate an optimal policy. Our method for learning and validating policies includes two systems: a simulation system where defender policies are incrementally learned and an emulation system where statistics are produced that drive simulation runs and where learned policies are evaluated. We show that our approach can produce effective defender policies for a practical IT infrastructure of limited size. Inspection of the learned policies confirms that they exhibit threshold properties.
Submission history
From: Kim Hammar [view email][v1] Sat, 30 Oct 2021 17:03:28 GMT (2131kb,D)
[v2] Mon, 17 Jan 2022 12:40:49 GMT (2853kb,D)
[v3] Mon, 24 Jan 2022 20:23:07 GMT (2853kb,D)
[v4] Mon, 31 Jan 2022 17:14:58 GMT (2852kb,D)
[v5] Sat, 5 Feb 2022 20:06:54 GMT (2852kb,D)
[v6] Thu, 17 Feb 2022 19:55:49 GMT (2950kb,D)
[v7] Fri, 1 Apr 2022 07:30:34 GMT (1209kb,D)
Link back to: arXiv, form interface, contact.