Network intrusion response using deep reinforcement learning in an aircraft IT-OT scenario

This paper presents an intrusion response system created using deep reinforcement learning, trained within an emulation environment. The emulation environment aims to represent a networked IT-OT system found within an aircraft. The goal of this paper’s experimentation is to explore training to defend against an attack chain in a way that more closely resembles a real network than that of current work. This has been achieved through the novel inclusion of open-source intrusion detection systems which feed default alert information to the response system. Experiments demonstrate the ability of the reinforcement learning agent to converge towards an effective response policy for defending the system against a multi-stage attack while minimizing disruption to do so.