Automated Cyber Defence with Reinforcement Learning in Multi-Attack Environments

Reinforcement learning (RL) has shown significant potential in enhancing cyber security by enabling autonomous agents to mitigate network attacks. However, attackers exhibit varying behaviours and knowledge levels, leading to diverse types of attacks. This paper investigates the effectiveness of specific and generic RL policies in mitigating different attacks. Our results demonstrate that while specific RL policies outperform generic ones, their effectiveness depends on correctly identifying the attack type to deploy the appropriate policy. We propose an approach, named Attack Identification for Reinforcement Learning (RLAI) to identify attacks in a network consisting of multiple attacks and normal users, ensuring suitable policy deployment for attack mitigation. Our results demonstrate that the Long Short-Term Memory (LSTM) model effectively identifies attacks while minimally affecting the policy’s rewards. Overall, RLAI improves mean rewards by 20.13%, showing the effectiveness of deploying specific RL policies by identifying attacks using an LSTM model.