DAY 2, 22 MAY
14:00 - 14:45
Security
ABOUT THE SPEAKER
For the last 15 years, Alexander has been analyzing malware and designing cybersecurity solutions. He founded the NioGuard Security Lab to conduct malware analysis, test anti-malware solutions, and perform AI/ML research in cybersecurity. Alexander holds a Ph.D. degree and has been teaching cybersecurity courses at Kharkiv National University of Electronics and BTH, Sweden. He is also a co-developer of the EU Master Program in Cybersecurity and trained the Cyberpolice of Ukraine as an OSCE expert.
Talk: Security Testing with Reinforcement Learning
Have you ever thought of security testing as a game? An attacker (tester) tries to find the way to defeat a target (app, computer, network) by discovering yet unknown vulnerabilities and weaknesses. Similarly, a chess player strives to force an opponent to make a mistake by choosing an appropriate game strategy. A security tester in order to discover a security flaw also follows a specific testing strategy. In most cases, a properly chosen strategy is the winning factor. But how to find it? This is where Fuzzing and Reinforcement Learning (RL) come into play. The testing strategy can be determined, for example, by setting a fitness (fuzzing) or reward (RL) function. Moreover, the latter (RL) approach can help to identify the “winning” strategy based on learning from previous actions. It is known fact, that AlphaGo, a computer program designed by DeepMind, has established itself as the best Go and chess player in the world as a result of playing many times with other instances of itself to improve its play with the help of RL.
In the talk, we’ll discuss RL’s capabilities for input generation as a part of security testing, in general, and its application for anti-malware testing, in particular. A possibility to create a cyberattack simulation using RL to bypass a cyber defense system will be shown.