Computer Science > Machine Learning
[Submitted on 30 Oct 2021 (v1), last revised 1 Apr 2022 (this version, v7)]
Title:Intrusion Prevention through Optimal Stopping
View PDFAbstract:We study automated intrusion prevention using reinforcement learning. Following a novel approach, we formulate the problem of intrusion prevention as an (optimal) multiple stopping problem. This formulation gives us insight into the structure of optimal policies, which we show to have threshold properties. For most practical cases, it is not feasible to obtain an optimal defender policy using dynamic programming. We therefore develop a reinforcement learning approach to approximate an optimal threshold policy. We introduce T-SPSA, an efficient reinforcement learning algorithm that learns threshold policies through stochastic approximation. We show that T-SPSA outperforms state-of-the-art algorithms for our use case. Our overall method for learning and validating policies includes two systems: a simulation system where defender policies are incrementally learned and an emulation system where statistics are produced that drive simulation runs and where learned policies are evaluated. We show that this approach can produce effective defender policies for a practical IT infrastructure.
Submission history
From: Kim Hammar [view email][v1] Sat, 30 Oct 2021 17:03:28 UTC (2,131 KB)
[v2] Mon, 17 Jan 2022 12:40:49 UTC (2,853 KB)
[v3] Mon, 24 Jan 2022 20:23:07 UTC (2,853 KB)
[v4] Mon, 31 Jan 2022 17:14:58 UTC (2,852 KB)
[v5] Sat, 5 Feb 2022 20:06:54 UTC (2,852 KB)
[v6] Thu, 17 Feb 2022 19:55:49 UTC (2,950 KB)
[v7] Fri, 1 Apr 2022 07:30:34 UTC (1,209 KB)
Current browse context:
cs.LG
References & Citations
Bibliographic and Citation Tools
Bibliographic Explorer (What is the Explorer?)
Litmaps (What is Litmaps?)
scite Smart Citations (What are Smart Citations?)
Code, Data and Media Associated with this Article
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub (What is DagsHub?)
Gotit.pub (What is GotitPub?)
Papers with Code (What is Papers with Code?)
ScienceCast (What is ScienceCast?)
Demos
Recommenders and Search Tools
Influence Flower (What are Influence Flowers?)
Connected Papers (What is Connected Papers?)
CORE Recommender (What is CORE?)
IArxiv Recommender
(What is IArxiv?)
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.