Detecting Stealthy Botnets in a Resource-Constrained Environment using Reinforcement Learning

摘要: Modern botnets can persist in networked systems for extended periods of time by operating a stealthy manner. Despite the progress made area botnet prevention, detection, and mitigation, continue to pose significant risk enterprises. Furthermore, existing enterprise-scale solutions require resources operate effectively, thus they are not practical. In order address this important problem resource-constrained environment, we propose reinforcement learning based approach optimally dynamically deploy limited number defensive mechanisms, namely honeypots network-based detectors, within target network. The ultimate goal proposed is reduce lifetime maximizing bots identified taken down through sequential decision-making process. We provide proof-of-concept approach, study its performance simulated environment. results show that promising protecting against botnets.