基于自适应推测的在线学习自动化安全响应
Automated Security Response through Online Learning with Adaptive Conjectures
AI总结：
针对IT基础设施自动化安全响应问题，将攻防交互建模为部分可观测非平稳博弈，提出推测在线学习（COL）方法，通过贝叶斯学习调整推测并滚动更新策略，实现比现有强化学习更快收敛的有效安全策略。
摘要：
我们研究IT基础设施的自动化安全响应，并将攻击者与防御者之间的交互建模为部分可观测、非平稳的博弈。我们放宽了博弈模型被正确指定的标准假设，考虑每个参与者对模型有一个概率推测，该推测可能存在错误指定（即真实模型的概率为0）。此建模方式可捕捉对基础设施和参与者意图的不确定性与误解。为在线学习有效的博弈策略，我们设计了推测在线学习（COL）这一新颖方法：参与者通过贝叶斯学习迭代调整其推测，并通过滚动更新策略。我们证明推测会收敛到最佳拟合，并提供了滚动在推测模型下实现性能提升的边界。为描述博弈的稳态，我们提出Berk-Nash均衡的变体。我们通过高级持续性威胁用例展示COL。测试平台评估表明COL能生成适应变化环境的有效安全策略，且COL比现有强化学习技术收敛更快。
英文摘要：
We study automated security response for an IT infrastructure and formulate the interaction between an attacker and a defender as a partially observed, non-stationary game. We relax the standard assumption that the game model is correctly specified and consider that each player has a probabilistic conjecture about the model, which may be misspecified in the sense that the true model has probability 0. This formulation allows us to capture uncertainty and misconception about the infrastructure and the intents of the players. To learn effective game strategies online, we design Conjectural Online Learning (COL), a novel method where a player iteratively adapts its conjecture using Bayesian learning and updates its strategy through rollout. We prove that the conjectures converge to best fits, and we provide a bound on the performance improvement that rollout enables with a conjectured model. To characterize the steady state of the game, we propose a variant of the Berk-Nash equilibrium. We present COL through an advanced persistent threat use case. Testbed evaluations show that COL produces effective security strategies that adapt to a changing environment. We also find that COL enables faster convergence than current reinforcement learning techniques.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
