More Like this

1. Finding Needles in a Moving Haystack: Prioritizing Alerts with Adversarial Reinforcement Learning

   Tong, Liang; Laszka, Aron; Yan, Chao; Zhang, Ning; Vorobeychik, Yevgeniy (January 2020, Proceedings of the AAAI Conference on Artificial Intelligence)

   Detection of malicious behavior is a fundamental problem in security. One of the major challenges in using detection systems in practice is in dealing with an overwhelming number of alerts that are triggered by normal behavior (the so-called false positives), obscuring alerts resulting from actual malicious activity. While numerous methods for reducing the scope of this issue have been proposed, ultimately one must still decide how to prioritize which alerts to investigate, and most existing prioritization methods are heuristic, for example, based on suspiciousness or priority scores. We introduce a novel approach for computing a policy for prioritizing alerts using adversarial reinforcement learning. Our approach assumes that the attackers know the full state of the detection system and dynamically choose an optimal attack as a function of this state, as well as of the alert prioritization policy. The first step of our approach is to capture the interaction between the defender and attacker in a game theoretic model. To tackle the computational complexity of solving this game to obtain a dynamic stochastic alert prioritization policy, we propose an adversarial reinforcement learning framework. In this framework, we use neural reinforcement learning to compute best response policies for both the defender and the adversary to an arbitrary stochastic policy of the other. We then use these in a double-oracle framework to obtain an approximate equilibrium of the game, which in turn yields a robust stochastic policy for the defender. Extensive experiments using case studies in fraud and intrusion detection demonstrate that our approach is effective in creating robust alert prioritization policies. 

   more » « less
2. A Game Theoretic Approach to Model Cyber Attack and Defense Strategies

   https://doi.org/10.1109/ICC.2018.8422719  

   Attiah, Afraa; Chatterjee, Mainak; Zou, Cliff C. (July 2018, IEEE International Conference on Communications)

   Most of the cybersecurity research focus on either presenting a specific vulnerability %or hacking technique, or proposing a specific defense algorithm to defend against a well-defined attack scheme. Although such cybersecurity research is important, few have paid attention to the dynamic interactions between attackers and defenders, where both sides are intelligent and will dynamically change their attack or defense strategies in order to gain the upper hand over their opponents. This 'cyberwar' phenomenon exists among most cybersecurity incidents in the real world, which warrants special research and analysis. In this paper, we propose a dynamic game theoretic framework (i.e., hyper defense) to analyze the interactions between the attacker and the defender as a non-cooperative security game. The key idea is to model attackers/defenders to have multiple levels of attack/defense strategies that are different in terms of effectiveness, strategy costs, and attack gains/damages. Each player adjusts his strategy based on the strategy's cost, potential attack gain/damage, and effectiveness in anticipating of the opponent's strategy. We study the achievable Nash equilibrium for the attacker-defender security game where the players employ an efficient strategy according to the obtained equilibrium. Furthermore, we present case studies of three different types of network attacks and put forth how our hyper defense system can successfully model them. Simulation results show that the proposed game theoretical system achieves a better performance compared to two other fixed-strategy defense systems. 

   more » « less
3. A Tannakian Framework for G-displays and Rapoport–Zink Spaces

   https://doi.org/10.1093/imrn/rnz311  

   Daniels, Patrick (December 2019, International Mathematics Research Notices)

   Abstract We develop a Tannakian framework for group-theoretic analogs of displays, originally introduced by Bültel and Pappas, and further studied by Lau. We use this framework to define Rapoport–Zink functors associated to triples $$(G,\{\mu \},[b])$$, where $$G$$ is a flat affine group scheme over $${\mathbb{Z}}_p$$ and $$\mu$$ is a cocharacter of $$G$$ defined over a finite unramified extension of $${\mathbb{Z}}_p$$. We prove these functors give a quotient stack presented by Witt vector loop groups, thereby showing our definition generalizes the group-theoretic definition of Rapoport–Zink spaces given by Bültel and Pappas. As an application, we prove a special case of a conjecture of Bültel and Pappas by showing their definition coincides with that of Rapoport and Zink in the case of unramified EL-type local Shimura data. 

   more » « less
4. Individualized Causal Discovery with Latent Trajectory Embedded Bayesian Networks

   https://doi.org/10.1111/biom.13843  

   Zhou, Fangting; He, Kejun; Ni, Yang (February 2023, Biometrics)

   Abstract Bayesian networks have been widely used to generate causal hypotheses from multivariate data. Despite their popularity, the vast majority of existing causal discovery approaches make the strong assumption of a (partially) homogeneous sampling scheme. However, such assumption can be seriously violated, causing significant biases when the underlying population is inherently heterogeneous. To this end, we propose a novel causal Bayesian network model, termed BN-LTE, that embeds heterogeneous samples onto a low-dimensional manifold and builds Bayesian networks conditional on the embedding. This new framework allows for more precise network inference by improving the estimation resolution from the population level to the observation level. Moreover, while causal Bayesian networks are in general not identifiable with purely observational, cross-sectional data due to Markov equivalence, with the blessing of causal effect heterogeneity, we prove that the proposed BN-LTE is uniquely identifiable under relatively mild assumptions. Through extensive experiments, we demonstrate the superior performance of BN-LTE in causal structure learning as well as inferring observation-specific gene regulatory networks from observational data. 

   more » « less
5. Games of GANs: Game-theoretical models for generative adversarial networks

   Monireh M. Moghadam, Bahar Boroomand (February 2023, Artificial intelligence review)

   Generative Adversarial Networks (GANs) have recently attracted considerable attention in the AI community due to their ability to generate high-quality data of significant statisti- cal resemblance to real data. Fundamentally, GAN is a game between two neural networks trained in an adversarial manner to reach a zero-sum Nash equilibrium profile. Despite the improvement accomplished in GANs in the last few years, several issues remain to be solved. This paper reviews the literature on the game-theoretic aspects of GANs and addresses how game theory models can address specific challenges of generative models and improve the GAN’s performance. We first present some preliminaries, including the basic GAN model and some game theory background. We then present a taxonomy to clas- sify state-of-the-art solutions into three main categories: modified game models, modified architectures, and modified learning methods. The classification is based on modifications made to the basic GAN model by proposed game-theoretic approaches in the literature. We then explore the objectives of each category and discuss recent works in each class. Finally, we discuss the remaining challenges in this field and present future research directions. 

   more » « less