Online symbolic learning of policies for explainable security

Drozdov, Arthur; Law, Mark; Lobo, Jorge; Russo, Alessandra; Wilathgamuwage Don, Mercion

doi:http://dx.doi.org/10.1109/TPSISA52974.2021.00030

Online symbolic learning of policies for explainable security

Citation

Drozdov A, Law M, Lobo J, Russo A, Wilathgamuwage Don M. Online symbolic learning of policies for explainable security. In: 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA): proceedings; 2021 Dec 13-15; Atlanta, United States. [Los Alamitos]: IEEE; 2021. p. 269-78. DOI: 10.1109/TPSISA52974.2021.00030

Abstract

Statistical Machine Learning (ML) has been proved to be an invaluable tool in many areas including privacy and security. On the other hand, recent advances in the field of Symbolic Learning have included novel scalable algorithms that learn highly accurate classifiers encoded as logic programs. In this paper we advocate adding Symbolic Learning to the security and privacy ML toolset. Through an example in anomaly detection, we present a framework for developing systems capable of performing symbolic-based learning of security policies. Our framework, called Online Learning of Anomaly detection Policies from Historical data (OLAPH), uses a symbolic learning system and a domain-specific function for scoring candidate rules to guide the learning process towards the best policies for anomaly detection. The learned policies are fully explainable since the underlying symbolic learning system is inherently explainable: there is a one-to-one mapping between the learned symbolic rules and the anomaly detection policies. The online feature of OLAPH uses a notion of policy confidence to decide when to relearn the policy and what data to relearn the policy from. OLAPH has been evaluated on a dataset of network requests from a commercial security provider, and shown to have a strong anomaly detection performance in addition to the usability and explainability benefits induced by its symbolic learning approach.

Description

Comunicació presentada a 2021 Third IEEE International Conference on Trust, Privacy and Security in Intelligent Systems and Applications (TPS-ISA), celebrat del 13 al 15 de desembre de 2021 de manera virtual.