论文标题
一种用于互动式检查安全策略的系统
A System for Interactive Examination of Learned Security Policies
论文作者
论文摘要
我们提出了一个用于互动研究的系统的系统。它允许用户以受控方式遍历马尔可夫决策过程，并跟踪安全策略触发的操作。与软件调试器类似，用户可以在任何时间步骤中继续或停止情节，并检查参数和概率分布的兴趣。该系统可以深入了解给定策略的结构以及在边缘案例中的策略行为。我们通过网络入侵用例演示系统。我们研究了IT基础架构状态的演变以及在发生攻击时安全政策规定的行动。演示的策略是通过加强学习方法获得的，该方法包括一个模拟系统，其中策略是逐步学习的，并产生驱动模拟运行的统计数据的仿真系统。
We present a system for interactive examination of learned security policies. It allows a user to traverse episodes of Markov decision processes in a controlled manner and to track the actions triggered by security policies. Similar to a software debugger, a user can continue or or halt an episode at any time step and inspect parameters and probability distributions of interest. The system enables insight into the structure of a given policy and in the behavior of a policy in edge cases. We demonstrate the system with a network intrusion use case. We examine the evolution of an IT infrastructure's state and the actions prescribed by security policies while an attack occurs. The policies for the demonstration have been obtained through a reinforcement learning approach that includes a simulation system where policies are incrementally learned and an emulation system that produces statistics that drive the simulation runs.
