2021

Zolotukhin, Mikhail; Hämäläinen, Timo; Immonen, Riku

The increasing number of connected IoT devices in recent years has led to a significant growth in the volume of cyber attack instances. Since the IoT devices include home automation sensors, medical equipment, vehicular sensors, nuclear reactors and life-critical real-time sensing devices, lack of security in IoT can pose a risk to human lives. In this study, we focus on the problem of attack detection and mitigation with the help of recently emerging reinforcement machine learning which has already demonstrated excellent suitability for several cyber security applications. In particular, we are implementing an intelligent agent which manipulates network security policies depending on the current state of the environment. These manipulations include pushing software-defined networking flows to the network controller as well as adjusting detection sensitivity of security appliances used for intrusion and anomaly detection. To encourage the environment exploration, the agent is provided with an intrinsic curiosity reward signal based on how hard it is for the agent to predict the consequences of its own actions. We evaluate the resulting framework against several attack scenarios using realistic network traffic datasets and the simulation results confirmed the viability of the approach proposed.