rlsecd: A Streaming RL Security Daemon

In my Security-Gym post I described the environment I built to generate realistic cybersecurity log streams for RL experiments. The next conditions I wanted to test were to see if a continual learning agent can actually detect attacks in this data running as a …

Security-Gym: A Streaming RL Benchmark from Real Attack Data

Over the past several months I've been running streaming RL experiments on real attack data extracted from a Cowrie SSH honeypot. The RL agent performance on the Cowrie data is promising and I wanted to continue testing different algorithms. However I …

Validating Streaming Deep RL on Attack Traffic

I'm continuing to focus on RL prediction steps 1/2 of the Alberta Plan. In my first experiment, I showed that IDBD diverges almost immediately on the real honeypot data I'm collecting and testing with. Given enough time Autostep fared much better but …

This post originated from comments John Carmack made on Lex Fridman's podcast (41:04) about motivators for software developers "Everything we're doing really should flow from user value". He goes on to talk about how exercises like code golf are great challenges and completing or "winning" them is a great …

This post is adapted from a paper I wrote for a masters course in early 2024.

Introduction

Ransomware is a global problem that has significant financial and business operations impact to organisations that are victims of attacks. The proliferation of Ransomware as a Service (RaaS) has led to an explosion …