Autonomous Response and Recovery in Large Industrial Control Networks with Deep Reinforcement Learning
Autonomous Attack Mitigation for Industrial Control Systems
We present a deep reinforcement learning approach to autonomous response and recovery in large industrial control networks.
We propose an attention-based neural architecture that is flexible to the size of the network under protection.
To train and evaluate the autonomous defender agent, we present an industrial control network simulation environment suitable for reinforcement learning.
Experiments show that the learned agent can effectively mitigate advanced attacks that progress with few observable signals over several months before execution.
The proposed deep reinforcement learning approach outperforms a fully automated playbook method in simulation, taking less disruptive actions while also defending more nodes on the network.
Authors
John Mern, Kyle Hatch, Ryan Silva, Cameron Hickert, Tamim Sookoor, Mykel J. Kochenderfer