A Model-Free Approach to Intrusion Response Systems

With the rising number of data breaches, denial service attacks and general malicious activity facing modern computer networks, there is an increasing need to quickly effectively respond attacks. Intrusion Detection Systems provide automated method identifying within a network however development Response System which can automatically these alerts non-trivial. Current research in IRS proposes model-based methods for possible routes actor may take when attacking use subjective performance values cost benefit response, both be invalidated by increasingly dynamic nature topologies system configurations. The proposed this work utilises Model-free Reinforcement Learning approach evaluates agent's stopping two distinct multi-stage attack scenarios on virtualised testbed. Experimentation demonstrates that agent successfully halt find responses have minimal impact normal operation based experience gained through training. A further contribution novel environment more realistic than simulated tasks common previous literature.