ARCS: Adaptive Reinforcement Learning Framework for Automated Cybersecurity Incident Response Strategy Optimization
The increasing sophistication and frequency of cyber attacks necessitate automated and intelligent response mechanisms that can adapt to evolving threats. This paper presents ARCS (Adaptive Reinforcement learning for Cybersecurity Strategy), a novel framework that leverages deep reinforcement learni...
Saved in:
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
MDPI AG
2025-01-01
|
| Series: | Applied Sciences |
| Subjects: | |
| Online Access: | https://www.mdpi.com/2076-3417/15/2/951 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| Summary: | The increasing sophistication and frequency of cyber attacks necessitate automated and intelligent response mechanisms that can adapt to evolving threats. This paper presents ARCS (Adaptive Reinforcement learning for Cybersecurity Strategy), a novel framework that leverages deep reinforcement learning to optimize automated incident response strategies in cybersecurity systems. Our approach uniquely combines state representation learning of security events with a hierarchical decision-making process to map attack patterns to optimal defense measures. The framework employs a custom reward mechanism that balances incident resolution time, system stability, and defense effectiveness. Using a comprehensive dataset of 20,000 cybersecurity incidents, we demonstrate that ARCS achieves 27.3% faster incident resolution times and 31.2% higher defense effectiveness compared to traditional rule-based approaches. The framework shows particular strength in handling complex, multi-stage attacks, reducing false positive rates by 42.8% while maintaining robust system performance. Through extensive experiments, we validated that our approach can effectively generalize across different attack types and adapt to previously unseen threat patterns. The results suggest that reinforcement learning-based automation can significantly enhance cybersecurity incident response capabilities, particularly in environments requiring rapid and precise defensive actions. |
|---|---|
| ISSN: | 2076-3417 |