Dynamic Scheduling of Cybersecurity Analysts for Minimizing Risk Using Reinforcement Learning

• DOI: 10.1145/2882969
• Publication Date: 2016-07-26T13:27:29Z
• Authors: Rajesh Ganesan; Sushil Jajodia; Ankit Shah; Hasan Cam
• Keywords: Staffing; Workforce management

An important component of the cyber-defense mechanism is adequate staffing levels its cybersecurity analyst workforce and their optimal assignment to sensors for investigating dynamic alert traffic. The ever-increasing threats faced by today’s digital systems require a strong that both reactive in response mitigate known risk proactive being prepared handling unknown risks. In order be risks, above must scheduled dynamically so system adaptive meet day-to-day stochastic demands on (both size expertise mix). stem from varying generation significance rate, which causes an uncertainty scheduler attempting schedule analysts work allocate analysts. Sensor data are analyzed automatic processing systems, alerts generated. A portion these categorized significant , requires thorough examination analyst. Risk, this article, defined as percentage not thoroughly minimize risk, it imperative accurately estimates future rate schedules workload demand analyze them. article presents reinforcement learning-based programming optimization model incorporates rates responds scheduling (i.e., maximize coverage analysts) maintain under pre-determined upper bound. tests compares results integer optimizes static needs based daily-average with no estimation (static model). Results indicate over finite planning horizon, model, through (on-call) addition workforce, (a) capable balancing between days reducing overall better than (b) scalable identifying quantity right mix organization, (c) able determine sensor-to-analyst allocation below given Several meta-principles presented, derived they further serve guiding principles hiring Days-off was performed weekly met system’s constraints requirements.