Inroads into Autonomous Network Defence using Explained Reinforcement Learning
This addresses the problem of reducing human involvement in network defense for cybersecurity, but it appears incremental as it builds on existing reinforcement learning approaches.
The paper tackles autonomous network defense by introducing an end-to-end methodology using explained reinforcement learning, achieving a substantial performance improvement over prior work.
Computer network defence is a complicated task that has necessitated a high degree of human involvement. However, with recent advancements in machine learning, fully autonomous network defence is becoming increasingly plausible. This paper introduces an end-to-end methodology for studying attack strategies, designing defence agents and explaining their operation. First, using state diagrams, we visualise adversarial behaviour to gain insight about potential points of intervention and inform the design of our defensive models. We opt to use a set of deep reinforcement learning agents trained on different parts of the task and organised in a shallow hierarchy. Our evaluation shows that the resulting design achieves a substantial performance improvement compared to prior work. Finally, to better investigate the decision-making process of our agents, we complete our analysis with a feature ablation and importance study.