Autonomous Security Policy Control Using PMC Anomaly Signals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems are vulnerable to malicious attacks and hardware or software faults, particularly in safety-critical contexts, and existing methods lack effective real-time protection without user intervention.
Innovation Solution
A software agent is trained using performance monitoring counter data and reinforcement learning to select security policies that mitigate threats while maintaining system performance, utilizing an anomaly detector for feedback and optimizing policies through a reward function.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If software is used to detect anomalous behavior and signal alerts, then detection capability is improved, but response effectiveness deteriorates due to lack of user availability in embedded systems
Solution Approach 1:
The system enables self-service by implementing an automated response mechanism where the software agent independently executes security policies without requiring user intervention. The anomaly detector triggers predefined security policies automatically, allowing the system to protect itself from threats in real-time, thus resolving the contradiction between detection capability and response effectiveness.
2Speed
If automated security policies are implemented without user intervention, then response speed is improved, but system complexity increases
Solution Approach 1:
The system applies preliminary action by pre-configuring multiple security policies before deployment. When an anomaly is detected, the system automatically selects and executes the appropriate pre-defined policy without requiring real-time user input or complex decision-making algorithms, thus achieving fast response while maintaining manageable system complexity.
3Reliability
If security policies are applied to mitigate threats, then system security is improved, but system performance deteriorates
Solution Approach 1:
The system implements partial action by applying security policies selectively rather than continuously. Security policies are activated only when anomalies are detected, allowing the system to maintain high performance during normal operation while providing strong security protection when threats are present, thus resolving the contradiction between security and performance.
Data Source
AI summary
A computer-implemented method of training a software agent for protecting a computer system includes receiving performance monitoring counter (PMC) data, including data from one or more hardware performance monitoring counters (PMCs) of the computer system, and receiving an output from an anomaly detector that is arranged to detect anomalies in the computer system. State data, including at least the PMC data, is provided to the software agent which selects a security policy from a set of security policies in dependence upon the state data, and applies the selected security policy to the computer system. A reward function is evaluated to determine a reward value which depends on at least the output of the anomaly detector. The reward value is used to train the software agent using reinforcement learning for selecting security policies from the set of security policies.