English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Zendy Plus

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Zendy Tools

Zendy Open

Cyber-security is an important societal concern. Cyber-attacks have increasedin numbers as well as in the extent of damage caused in every attack. Largeorganizations operate a Cyber Security Operation Center (CSOC), which form thefirst line of cyber-defense. The inspection of cyber-alerts is a critical partof CSOC operations. A recent work, in collaboration with Army Research Lab, USAproposed a reinforcement learning (RL) based approach to prevent thecyber-alert queue length from growing large and overwhelming the defender.Given the potential deployment of this approach to CSOCs run by US defenseagencies, we perform a red team (adversarial) evaluation of this approach.Further, with the recent attacks on learning systems, it is even more importantto test the limits of this RL approach. Towards that end, we learn anadversarial alert generation policy that is a best response to the defenderinspection policy. Surprisingly, we find the defender policy to be quite robustto the best response of the attacker. In order to explain this observation, weextend the earlier RL model to a game model and show that there exists defenderpolicies that can be robust against any adversarial policy. We also derive acompetitive baseline from the game theory model and compare it to the RLapproach. However, we go further to exploit assumptions made in the MDP in theRL model and discover an attacker policy that overwhelms the defender. We use adouble oracle approach to retrain the defender with episodes from thisdiscovered attacker policy. This made the defender robust to the discoveredattacker policy and no further harmful attacker policies were discovered.Overall, the adversarial RL and double oracle approach in RL are generaltechniques that are applicable to other RL usage in adversarial environments.

Two Can Play That Game: An Adversarial Evaluation of a Cyber-alert Inspection System