Coordinated team learning and difference rewards for distributed intrusion response

TY - GEN

T1 - Coordinated team learning and difference rewards for distributed intrusion response

AU - Malialis, Kleanthis

AU - Devlin, Sam

AU - Kudenko, Daniel

PY - 2014

Y1 - 2014

N2 - Distributed denial of service attacks constitute a rapidly evolving threat in the current Internet. Multiagent Router Throttling is a novel approach to respond to such attacks. We demonstrate that our approach can significantly scale-up using hierarchical communication and coordinated team learning. Furthermore, we incorporate a form of reward shaping called difference rewards and show that the scalability of our system is significantly improved in experiments involving over 100 reinforcement learning agents. We also demonstrate that difference rewards constitute an ideal online learning mechanism for network intrusion response. We compare our proposed approach against a popular state-of-the-art router throttling technique from the network security literature, and we show that our proposed approach significantly outperforms it. We note that our approach can be useful in other related multiagent domains.

AB - Distributed denial of service attacks constitute a rapidly evolving threat in the current Internet. Multiagent Router Throttling is a novel approach to respond to such attacks. We demonstrate that our approach can significantly scale-up using hierarchical communication and coordinated team learning. Furthermore, we incorporate a form of reward shaping called difference rewards and show that the scalability of our system is significantly improved in experiments involving over 100 reinforcement learning agents. We also demonstrate that difference rewards constitute an ideal online learning mechanism for network intrusion response. We compare our proposed approach against a popular state-of-the-art router throttling technique from the network security literature, and we show that our proposed approach significantly outperforms it. We note that our approach can be useful in other related multiagent domains.

UR - http://www.scopus.com/inward/record.url?scp=84923167666&partnerID=8YFLogxK

U2 - 10.3233/978-1-61499-419-0-1063

DO - 10.3233/978-1-61499-419-0-1063

M3 - Conference contribution

AN - SCOPUS:84923167666

VL - 263

T3 - Frontiers in Artificial Intelligence and Applications

SP - 1063

EP - 1064

BT - ECAI 2014

PB - IOS Press

T2 - 21st European Conference on Artificial Intelligence, ECAI 2014

Y2 - 18 August 2014 through 22 August 2014

ER -