A System for Interactive Examination of Learned Security Policies
Kim Hammar, Rolf Stadler

TL;DR
This paper introduces an interactive system for examining learned security policies in detail, allowing users to explore policy behavior during simulated security scenarios, aiding understanding and debugging.
Contribution
It presents a novel interactive tool for inspecting and understanding security policies learned via reinforcement learning in network security contexts.
Findings
System enables detailed policy analysis during simulated attacks
Demonstrates insights into policy behavior in edge cases
Facilitates debugging and comprehension of learned policies
Abstract
We present a system for interactive examination of learned security policies. It allows a user to traverse episodes of Markov decision processes in a controlled manner and to track the actions triggered by security policies. Similar to a software debugger, a user can continue or or halt an episode at any time step and inspect parameters and probability distributions of interest. The system enables insight into the structure of a given policy and in the behavior of a policy in edge cases. We demonstrate the system with a network intrusion use case. We examine the evolution of an IT infrastructure's state and the actions prescribed by security policies while an attack occurs. The policies for the demonstration have been obtained through a reinforcement learning approach that includes a simulation system where policies are incrementally learned and an emulation system that produces…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Code & Models
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsNetwork Security and Intrusion Detection · Information and Cyber Security · Smart Grid Security and Resilience
