kth.sePublications KTH
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Structural Generalization in Autonomous Cyber Incident Response with Message-Passing Neural Networks and Reinforcement Learning
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering.ORCID iD: 0000-0003-2663-0708
KTH, School of Electrical Engineering and Computer Science (EECS), Computer Science, Network and Systems Engineering. RISE Res Inst Sweden Chem Mat & Surfaces, SE-11486 Stockholm, Sweden.;Univ New South Wales, Sch Chem, Sydney, NSW 2052, Australia.;Ecole Cent Lyon, Lab Tribol & Dynam Syst, F-69134 Ecully, France..ORCID iD: 0000-0002-3293-1681
2024 (English)In: 2024 IEEE INTERNATIONAL CONFERENCE ON CYBER SECURITY AND RESILIENCE, CSR, 2024, p. 282-289Conference paper, Published paper (Refereed)
Abstract [en]

We believe that agents for automated incident response based on machine learning need to handle changes in network structure. Computer networks are dynamic, and can naturally change in structure over time. Retraining agents for small network changes costs time and energy. We attempt to address this issue with an existing method of relational agent learning, where the relations between objects are assumed to remain consistent across problem instances. The state of the computer network is represented as a relational graph and encoded through a message passing neural network. The message passing neural network and an agent policy using the encoding are optimized end-to-end using reinforcement learning. We evaluate the approach on the second instance of the Cyber Autonomy Gym for Experimentation (CAGE 2), a cyber incident simulator that simulates attacks on an enterprise network. We create variants of the original network with different numbers of hosts and agents are tested without additional training on them. Our results show that agents using relational information are able to find solutions despite changes to the network, and can perform optimally in some instances. Agents using the default vector state representation perform better, but need to be specially trained on each network variant, demonstrating a trade-off between specialization and generalization.

Place, publisher, year, edition, pages
2024. p. 282-289
Keywords [en]
cyber security, reinforcement learning, graph learning, relational learning, generalization
National Category
Computer Sciences
Identifiers
URN: urn:nbn:se:kth:diva-356458DOI: 10.1109/CSR61664.2024.10679456ISI: 001327167900042Scopus ID: 2-s2.0-85206191645OAI: oai:DiVA.org:kth-356458DiVA, id: diva2:1914409
Conference
4th IEEE Annual International Conference on Cyber Security and Resilience (IEEE CSR), SEP 02-04, 2024, London, ENGLAND
Note

QC 20241119

Part of ISBN 979-8-3503-7536-7

Available from: 2024-11-19 Created: 2024-11-19 Last updated: 2024-11-19Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Nyberg, JakobJohnson, Pontus

Search in DiVA

By author/editor
Nyberg, JakobJohnson, Pontus
By organisation
Network and Systems Engineering
Computer Sciences

Search outside of DiVA

GoogleGoogle Scholar

doi
urn-nbn

Altmetric score

doi
urn-nbn
Total: 77 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • modern-language-association-8th-edition
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf