We introduce a reinforcement learning based containment system for self-propagating malware in local networks. The system is trained with real-world software and malware and leverages a network of virtual machines for execution and propagation. Instead of relying on labels as is common with supervised learning, we follow a trial-and-error approach in order to learn how to link network traffic to malware infections.

Top