Multiple deception resources deployment strategy based on reinforcement learning for network threat mitigation

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Network Defense

Background:

• Advanced Persistent Threats (APTs) present significant challenges to information system security.
• Active defense methods, like deception defense (DD) with honeypots, are common but face resource constraints.
• Effective deployment of deception resources is crucial for mitigating APT risks.

Purpose of the Study:

• To propose a reinforcement learning-based algorithm for generating multi-type deception resource deployment strategies.
• To address the challenge of deploying deception resources in resource-constrained environments during the APT network reconnaissance stage.
• To balance defense effectiveness and defense cost in APT mitigation.

Main Methods:

• Developed a reinforcement learning algorithm for generating deception resource deployment strategies.
• Analyzed network assets and attack processes to inform strategy generation.
• Balanced defense effectiveness and defense cost as key optimization parameters.

Main Results:

• Achieved a 97.09% defensive success probability, outperforming baseline methods.
• Reduced the attack probability of target assets by at least 10.34%.
• Demonstrated algorithm convergence, stability, and efficiency in reducing defense costs.

Conclusions:

• The proposed algorithm effectively enhances defense efficiency against APTs.
• It provides a viable solution for optimizing deception resource deployment in constrained systems.
• The approach successfully reduces defense costs while maintaining high security effectiveness.