Abstract:Network security is a critical discipline in the contemporary digital world, encompassing diverse technologies and strategies aimed at safeguarding computer systems, networks, and data resources against malicious activities. The attackers and defenders are vital components in the context of network security and defense. Attackers employ various means to steal sensitive information, compromise system functionality, and potentially lead to substantial economic and societal damages. To address these challenges, various network attack and defense scenarios were constructed within the CybORG framework in this paper. In various scenarios, attacks were carried out by different attackers. This was done to investigate the diverse strategies employed by defenders in response to network intrusions across different scenarios. Additionally, real-time assessments of the effectiveness of defensive measures were conducted. To assess the efficacy of defense strategies, we propose DDQN-Dueling-Noisy-Experience Replay (DDQN-DNER), a deep reinforcement learning algorithm that trains the defense agent to take appropriate actions to protect the network as it transitions into various states of being under attack. Built upon the Deep Q-Network (DQN) algorithm, the DDQN-DNER method incorporates noise networks, additional experience replay, and distinguishes outputs into value functions and advantage functions, enabling the proactive updating of Q-network parameters based on optimal actions. Simultaneously, Gaussian noise is incorporated into the actions undertaken by the agents. Research findings indicate that as network complexity increases, it becomes more challenging for agents to formulate effective strategies, while lower network security enhances agent capability in strategic decision-making. Compared to the DDQN algorithm, the DDQN-DNER algorithm accelerates the convergence of the model. In all scenarios, this algorithm consistently achieves the highest scores, indicating that the defensive strategies and measures generated by the blue agent are highly effective. The blue agent can promptly detect potential threats and attacks and take appropriate actions to address and mitigate these attacks, thereby ensuring network security.

Network Defense Strategy Selection with Reinforcement Learning and Pareto Optimization

Analysis of Network Attack and Defense Strategies Based on Pareto Optimum

Pareto Optimal Solutions for Network Defense Strategy Selection Simulator in Multi-Objective Reinforcement Learning

Optimal Network Defense Strategy Selection Method: A Stochastic Differential Game Model

Optimal Network Defense Strategy Selection Based on Bayesian Game

Network Security Defense Decision-Making Method Based on Stochastic Game and Deep Reinforcement Learning

Network defense decision-making based on deep reinforcement learning and dynamic game theory

Game-Model-Based Network Security Risk Control.

Network System Security Analysis Based on Game Strategies Graph

Strategy Selection for Moving Target Defense in Incomplete Information Game

Defense Strategy Selection Model Based on Multistage Evolutionary Game Theory

Optimal Defense Strategy Based on the Mean Field Game Model for Cyber Security

Network security optimal attack and defense decision-making method based on game model

Optimal Network Security Strengthening Using Attack-Defense Game Model

A method of network attack-defense game and collaborative defense decision-making based on hierarchical multi-agent reinforcement learning

Finding Effective Security Strategies through Reinforcement Learning and Self-Play

Optimal Defense Resource Allocation Considering Nonlinear Attack Cost in Power Systems

Effective Defense Strategies in Network Security Using Improved Double Dueling Deep Q-network

Establishing an Optimal Network Defense System: A Monte Carlo Graph Search Method.

Social Engineering Attack-Defense Strategies Based on Reinforcement Learning

Computing Effective Mixed Strategies for Protecting Targets in Large-Scale Critical Infrastructure Networks