Solving Cyber-Alert Allocation Markov Games with Deep Reinforcement Learning

Simple item page
dc.contributor.advisorGuirguis, Mina
dc.contributor.authorDunstatter, Noah
dc.contributor.committeeMemberTesic, Jelena
dc.contributor.committeeMemberGu, Qijun
dc.date.accessioned2019-05-06T19:41:54Z
dc.date.available2019-05-06T19:41:54Z
dc.date.issued2019-05
dc.description.abstractMost large scale networks employ some kind of intrusion detection software on their computer systems (e.g., servers, routers, etc.) that monitor and flag suspicious or abnormal activity. When possibly malicious activity is detected, one or more cyber-alerts may be generated with varying levels of significance (e.g., high, medium, or low). Some subset of these alerts may then be assigned to cyber-security analysts on staff for further investigation. Due to the wide range of potential attacks and the high degrees of attack sophistication, identifying what constitutes a true attack is a challenging problem – especially for organizations performing critical operations, like military bases or financial institutions, that are constantly subjected to high volumes of cyber-attacks every day. In this thesis, we develop a framework that allows us to study what game-theoretic behavior looks like from both the attacker and defender’s perspective. Our approach considers a series of sub-games between the attacker and defender in which a state is maintained between each sub-game. We first derive optimal allocation strategies via the use of dynamic programming and Q-maximin value iteration based algorithms. We then move into approximation techniques, using deep neural networks and Q-learning to derive near-optimal strategies that allow us to explore much larger models. We assess the effectiveness of our allocation strategies by comparing them to other sensible heuristics (e.g., random and myopic) with our results showing that we consistently outperform these other strategies at minimizing risk.
dc.description.departmentComputer Science
dc.formatText
dc.format.extent51 pages
dc.format.medium1 file (.pdf)
dc.identifier.citationDunstatter, N. (2019). Solving cyber-alert allocation Markov games with deep reinforcement learning (Unpublished thesis). Texas State University, San Marcos, Texas.
dc.identifier.urihttps://hdl.handle.net/10877/8144
dc.language.isoen
dc.subjectgame theory
dc.subjectnetwork security
dc.subjectreinforcement learning
dc.subjectmachine learning
dc.subjectMarkov games
dc.subjectcyber alert allocation
dc.titleSolving Cyber-Alert Allocation Markov Games with Deep Reinforcement Learning
dc.typeThesis
thesis.degree.departmentComputer Science
thesis.degree.disciplineComputer Science
thesis.degree.grantorTexas State University
thesis.degree.levelMasters
thesis.degree.nameMaster of Science

Files

Original bundle

Now showing 1 - 1 of 1
Thumbnail Image
Name:
DUNSTATTER-THESIS-2019.pdf
Size:
798.06 KB
Format:
Adobe Portable Document Format
Download

License bundle

Now showing 1 - 2 of 2
No Thumbnail Available
Name:
PROQUEST_LICENSE.txt
Size:
4.53 KB
Format:
Plain Text
Description:
Download
No Thumbnail Available
Name:
LICENSE.txt
Size:
2.13 KB
Format:
Plain Text
Description:
Download

Collections

Graduate Theses and Dissertations