A Resource Scheduling Method for Detecting Advanced Persistent Threats Based on Reinforcement Learning

Abstract

The invention relates to a reinforcement learning-based resource scheduling method for detecting advanced persistent threats and belongs to the computer and information security field. As for a computer or cloud storage system, the CPU and other computing resources of the computer or cloud storage system are scheduled to detect APT (advanced persistent threat) attacks; neural episodic control learning is adopted, so that APT attack models are not required to be known in advance, and the detection resource scheduling strategy of a dynamic data storage system is optimized; on the basis of a deep convolutional neural network and episodic memory, the state space of APT detection is compressed; an episodic memory module is utilized to store resource allocation experiences; contextual environment information is fully utilized; and therefore, cognition for the new features of APT attack defense is accelerated, and learning speed is increased. The method can be applied to dynamic cloud storage environments and attack modes, improve the data privacy performance of the computer and cloud storage system under APT attacks.

Description

technical field [0001] The invention relates to computer and information security, in particular to a resource scheduling method for detecting advanced persistent threats based on reinforcement learning. Background technique [0002] With the rapid development of cloud computing technology, cloud storage technology under the background of big data has been familiar and used by more and more enterprises and individuals. While cloud storage provides us with convenience, its security has increasingly attracted our attention. The cloud storage system carries a large amount of privacy-sensitive data such as corporate files and private information. In 2016, 500 million Yahoo user accounts were leaked, and in the same year, 31 million U.S. dollars was stolen from the Central Bank of Russia. Therefore, the security and privacy of cloud storage systems have become the key factors restricting its future development. [0003] Advanced Persistent Threat (APT) refers to an attack form ...

AI Technical Summary

Problems solved by technology

[0005] Many current solutions do not fully consider the resource-limited scenario of the defense system, but this limitation is one of the key factors for the defense system to formulate a detection resource scheduling plan

At the same time, the learning speed of reinforcement learning algorithms such as Q-learning algorithm will drop rapidly when the state set and action set dimension are large.

These problems restrict the application of reinforcement learning algorithms

Images