归纳式自主网络事件响应智能体的网络靶场评估
A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents
Jakob Nyberg, Teodor Sommestad, Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt
AI 速读 基于摘要
作者在可变拓扑的虚拟化网络中评估结合关系数据库建模与强化学习的归纳式入侵响应智能体，并与启发式策略和人工操作员比较。
cs.CR · cs.AI
查看原文摘要
We have applied a novel combination of classic relational database modeling and modern reinforcement learning to automated intrusion response to enable inductive decision agents. Unlike previous work in the area, our approach allows agents to handle variable quantities of network assets without retraining. We test the operational performance of our approach in a virtualized computer network with variable topologies, red-team automation and simulated user agents. The task of the agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. We test a combination of heuristic agents and policies trained using relational reinforcement learning. The reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and the closest to the performance of human operators at the task.