Automated intrusion response

A KTH lab agent reboots industrial hosts on six packet counts per interval

The reinforcement-learning defender was trained on 40,000 half-minute traffic samples from a container replica of a segmented plant network, and its best-performing version works from a model of the attacker it is fighting.