用强化学习集体防御，让高级持续性攻击无处遁形
Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection
- 多智能体强化学习+自编码器，动态识别异常行为
- 不确定时自动触发专家反馈，持续优化判断边界
- 适合安全团队部署，对抗不断演化的黑客策略
高级持续性威胁（APTs）对现代数字基础设施构成日益严重的威胁。与传统攻击不同，APTs具有隐蔽性、适应性和持久性，常能绕过基于签名的检测系统。本文提出一种融合深度学习、强化学习（RL）与主动学习的新框架，构建可自适应的防御体系。系统采用自编码器提取行为潜在特征，再由多个基于RL的防御者（包括Q-Learning、PPO、DQN及对抗性防御者）协同分析。当任一代理对判断存疑时，系统启动主动学习循环，模拟专家反馈以优化决策边界。最终通过加权投票机制融合各代理输出，提升预测鲁棒性。
原文摘要 · Abstract (English)
Advanced Persistent Threats (APTs) represent a growing menace to modern digital infrastructure. Unlike traditional cyberattacks, APTs are stealthy, adaptive, and long-lasting, often bypassing signature-based detection systems. This paper introduces a novel framework for APT detection that unites deep learning, reinforcement learning (RL), and active learning into a cohesive, adaptive defense system. Our system combines auto-encoders for latent behavioral encoding with a multi-agent ensemble of RL-based defenders, each trained to distinguish between benign and malicious process behaviors. We identify a critical challenge in existing detection systems: their static nature and inability to adapt to evolving attack strategies. To this end, our architecture includes multiple RL agents (Q-Learning, PPO, DQN, adversarial defenders), each analyzing latent vectors generated by an auto-encoder. When any agent is uncertain about its decision, the system triggers an active learning loop to simulate expert feedback, thus refining decision boundaries. An ensemble voting mechanism, weighted by each agent's performance, ensures robust final predictions.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。