We have applied a novel combination of classic relational database modeling and modern reinforcement learning to automated intrusion response to enable inductive decision agents. Unlike previous work in the area, our approach allows agents to handle variable quantities of network assets without retraining. We test the operational performance of our approach in a virtualized computer network with variable topologies, red-team automation and simulated user agents. The task of the agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. We test a combination of heuristic agents and policies trained using relational reinforcement learning. The reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and the closest to the performance of human operators at the task.

翻译：暂无翻译