A Performance Evaluation of Deep Reinforcement Learning for Model-Based Intrusion Response

Given the always increasing size of computer systems, manually protecting them in case of attacks is infeasible and error-prone. For this reason, several Intrusion Response Systems (IRSs) have been proposed so far, with the purpose of limiting the amount of work of an administrator. However, since the most advanced IRSs adopt a stateful approach, they are subject to what Bellman defined as the curse of dimensionality. In this paper, we propose an approach based on deep reinforcement learning which, to the best of our knowledge, has never been used until now for intrusion response. Experimental results show that the proposed approach reduces the time needed for the computation of defense policies by orders of magnitude, while providing near-optimal rewards.