A Cyber Range Evaluation of Autonomous Network Incident Response Agents
Cyber range evaluation shows reinforcement learning incident response agents defend emulated networks more efficiently than heuristic policies, depending heavily on adversary behavior.
The paper evaluates agents for automated network intrusion response in a cyber range designed for human operator training, featuring variable topology, red-team emulation, and simulated users. Alerts are generated by a SIEM platform and mapped to a data modeling language used by the agents, with reinforcement learning policies optimized to minimize combined defense and availability costs using a cyber attack simulator. Reinforcement learning agents defended the system more efficiently than heuristic policies, with performance highly dependent on the adversary policy and simulated user behavior.
- RL agents outperform heuristic policies defending hosts in an emulated network range
- Policies trained in a simulator minimize combined defense and availability cost
- Performance depends heavily on adversary policy and simulated user behavior
- SIEM alerts mapped to a data modeling language consumed by the agents
From the original article
1 min read at arxiv.orgWe test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents.
By Jakob Nyberg · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.