Real-Time Defensive Strategy Selection via Deep Reinforcement Learning

As computer networks face increasingly sophisticated attacks there is a need to create adaptive defensive systems that can select appropriate countermeasures to thwart attacks. The use of Deep Reinforcement Learning to train defensive agents is an avenue to study to meet this demand. In this paper we describe a simulated computer network environment wherein we conduct attacks and train defensive agents that employ Moving Target Defense and Deception strategies. We train an attacking agent, using Proximal Policy Optimization, to learn a policy to extract sensitive network data as quickly as possible from the environment. We then train a defending agent to prevent the attacker from reaching its objective. Our results demonstrate how the defender is able to learn a policy to inhibit the attacker.