Strategic Planning for Network Data Analysis

TL;DR

This paper introduces the 'strategic planning' problem for automated network data analysis, applying automated planning methods to optimize decision-making in real-time system monitoring.

Contribution

It presents a novel formulation of the strategic planning problem using PDDL, and demonstrates an integrated system with evaluations on real network data and simulation.

Findings

Automated planners showed varied capabilities in real-world scenarios.

The integrated system effectively managed network monitoring tasks.

Planning methods scaled to real-time, large-scale network data.

Abstract

As network traffic monitoring software for cybersecurity, malware detection, and other critical tasks becomes increasingly automated, the rate of alerts and supporting data gathered, as well as the complexity of the underlying model, regularly exceed human processing capabilities. Many of these applications require complex models and constituent rules in order to come up with decisions that influence the operation of entire systems. In this paper, we motivate the novel "strategic planning" problem -- one of gathering data from the world and applying the underlying model of the domain in order to come up with decisions that will monitor the system in an automated manner. We describe our use of automated planning methods to this problem, including the technique that we used to solve it in a manner that would scale to the demands of a real-time, real world scenario. We then present a PDDL model of one such application scenario related to network administration and monitoring, followed by a description of a novel integrated system that was built to accept generated plans and to continue the execution process. Finally, we present evaluations of two different automated planners and their different capabilities with our integrated system, both on a six-month window of network data, and using a simulator.