• Home
  • Search
  • Dynamic Scheduling of Cybersecurity Analysts for Minimizing Risk Using Reinforcement Learning
  • Cite Icon57
  • https://doi.org/10.1145/2882969Copy DOI Icon

Dynamic Scheduling of Cybersecurity Analysts for Minimizing Risk Using Reinforcement Learning

Show More
  • Abstract
  • Literature Map
  • References
  • Citations
  • Similar Papers
Abstract

An important component of the cyber-defense mechanism is the adequate staffing levels of its cybersecurity analyst workforce and their optimal assignment to sensors for investigating the dynamic alert traffic. The ever-increasing cybersecurity threats faced by today’s digital systems require a strong cyber-defense mechanism that is both reactive in its response to mitigate the known risk and proactive in being prepared for handling the unknown risks. In order to be proactive for handling the unknown risks, the above workforce must be scheduled dynamically so the system is adaptive to meet the day-to-day stochastic demands on its workforce (both size and expertise mix). The stochastic demands on the workforce stem from the varying alert generation and their significance rate, which causes an uncertainty for the cybersecurity analyst scheduler that is attempting to schedule analysts for work and allocate sensors to analysts. Sensor data are analyzed by automatic processing systems, and alerts are generated. A portion of these alerts is categorized to be significant , which requires thorough examination by a cybersecurity analyst. Risk, in this article, is defined as the percentage of significant alerts that are not thoroughly analyzed by analysts. In order to minimize risk, it is imperative that the cyber-defense system accurately estimates the future significant alert generation rate and dynamically schedules its workforce to meet the stochastic workload demand to analyze them. The article presents a reinforcement learning-based stochastic dynamic programming optimization model that incorporates the above estimates of future alert rates and responds by dynamically scheduling cybersecurity analysts to minimize risk (i.e., maximize significant alert coverage by analysts) and maintain the risk under a pre-determined upper bound. The article tests the dynamic optimization model and compares the results to an integer programming model that optimizes the static staffing needs based on a daily-average alert generation rate with no estimation of future alert rates (static workforce model). Results indicate that over a finite planning horizon, the learning-based optimization model, through a dynamic (on-call) workforce in addition to the static workforce, (a) is capable of balancing risk between days and reducing overall risk better than the static model, (b) is scalable and capable of identifying the quantity and the right mix of analyst expertise in an organization, and (c) is able to determine their dynamic (on-call) schedule and their sensor-to-analyst allocation in order to maintain risk below a given upper bound. Several meta-principles are presented, which are derived from the optimization model, and they further serve as guiding principles for hiring and scheduling cybersecurity analysts. Days-off scheduling was performed to determine analyst weekly work schedules that met the cybersecurity system’s workforce constraints and requirements.

Similar Papers
  • Conference Article
  • Citations27

READYS: A Reinforcement Learning Based Strategy for Heterogeneous Dynamic Scheduling

  • Sep 01, 2021
  • Nathan Grinsztajn +3
  • Conference Article
  • Citations15

Implementation of advanced control for a heat-integrated distillation column system

  • Nov 02, 2004
  • Xuemei Zhu +2
  • PDF
  • Research Article
  • Citations1

RGV dynamic scheduling optimization model based on greedy algorithm

  • Jan 01, 2018
  • Advances in Computer, Signals and Systems
  • Xu Yuan +2
  • Research Article
  • Citations12

Approximation Algorithms for Dynamic Assortment Optimization Models

  • Aug 08, 2015
  • SSRN Electronic Journal
  • Ali Aouad +2
  • Research Article
  • Citations3

Design of Interactive Cultural Brand Marketing System based on Cloud Service Platform

  • Mar 01, 2022
  • 網際網路技術學刊
  • Ziwei Pan Ziwei Pan
  • Research Article
  • Citations153

Energy minimization in dynamic train scheduling and control for metro rail operations

  • Oct 21, 2014
  • Transportation Research Part B: Methodological
  • Xiang Li +1
  • Research Article

The Deep Learning-Based Security Assessment and Optimization Model for Enterprise Information Systems Under Digital Economy

  • Jun 20, 2025
  • Journal of Organizational and End User Computing
  • Jin Qiu +2
  • Conference Article
  • Citations1

A New Joint Data-Model Driven Dynamic Scheduling Architecture for Intelligent Workshop

  • Jun 10, 2019
  • Kunkun Peng +4
  • Dissertation
  • Citations1

Deep reinforcement learning-based dynamic scheduling

  • Jan 01, 2022
  • Renke Liu
  • Research Article

Research on multi-rider collaborative dynamic scheduling model and algorithm of takeaway delivery

  • Dec 08, 2023
  • Advances in Engineering Technology Research
  • Siqi Zhang +1
  • Research Article

An Integrated Multi-Objective Decision Model under Considering Stochastic Demand, Price Breaks and Disruption Risk for Order Allocation in a Multiple-Supplier Environment

  • Feb 21, 2011
  • Advanced Materials Research
  • Wei Pan +3
  • Research Article
  • Citations15

Dynamic scheduling model for the construction industry

  • Jan 20, 2020
  • Built Environment Project and Asset Management
  • Amer Fahmy +3
  • Conference Article

Emergency voltage control based on MPC, Radau collocation and moving finite elements technique

  • Oct 01, 2010
  • Shuang Wang +4
  • Research Article
  • Citations6

Comparison of dynamic scheduling policies for hybrid make-to-order and make-to-stock production systems with stochastic demand

  • Oct 12, 2004
  • International Journal of Production Economics
  • Chetan Soman +2
  • Research Article
  • Citations83

Integration of set point optimization techniques into nonlinear MPC for improving the operation of WWTPs

  • May 01, 2014
  • Computers & Chemical Engineering
  • P Vega +3
Cactus Communications logo

Copyright 2026 Cactus Communications. All rights reserved.