Reinforcement Learning for Autonomous Defence in Software-Defined Networking

Abstract

Despite the successful application of machine learning (ML) in a wide range of domains, adaptabilitythe very property that makes machine learning desirable-can be exploited by adversaries to contaminate training and evade classification. In this paper, we investigate the feasibility of applying a specific class of machine learning algorithms, namely, reinforcement learning (RL) algorithms, for autonomous cyber defence in software-defined networking (SDN). In particular, we focus on how an RL agent reacts towards different forms of causative attacks that poison its training process, including indiscriminate and targeted, white-box and black-box attacks. In addition, we also study the impact of the attack timing, and explore potential countermeasures such as adversarial training.

Machine Learning Threatens 5G Security

“…To deal with such problems by logically distributing the control planes, reinforcement learning mechanisms will not only facilitate coordination but also help to improve in improving resilience, as demonstrated in [129]. Reinforcement learning can also be explicitly used to improve the security of SDNs autonomously [130]. related NFV components in the security architecture [136], [137] include the NFV Security Controller, which orchestrates system-wide security policies, and security analytic services, which receive monitoring telemetry across NFV systems and apply ML to detect emerging threats.…”

Robust Self-Protection Against Application-Layer (D)DoS Attacks in SDN Environment

“…Adversarial Machine Learning (AML) [19] is an emerging research discipline that focuses on making ML techniques resilient to adversarial attacks by assessing their vulnerability to attacks and devising appropriate countermeasures. Unlike computer vision field, very few contributions (e.g., [20]) have been targeted at ML security in the context of networking field. The work in [20] investigates the resilience of RL to different forms of poisoning attacks in the context of autonomous cyber-defense in SDNs.…”

“…Unlike computer vision field, very few contributions (e.g., [20]) have been targeted at ML security in the context of networking field. The work in [20] investigates the resilience of RL to different forms of poisoning attacks in the context of autonomous cyber-defense in SDNs. While the authors have briefly discussed the potential countermeasures, they did not implement any defense strategy.…”

$$\mathsf {QFlip}$$ : An Adaptive Reinforcement Learning Strategy for the $$\mathsf {FlipIt}$$ Security Game

“…RL has emerged in security games in recent years. Han et al use RL for adaptive cyber-defense in a Software-Defined Networking setting and consider adversarial poisoning attacks against the RL training process [9]. Hu et al proposes the idea of using Q-Learning as a defensive strategy in a cybersecurity game for detecting APT attacks in IoT systems [11].…”