A Cyber Range Evaluation of Autonomous Network Incident Response Agents
Cyber range evaluation shows reinforcement learning incident response agents defend emulated networks more efficiently than heuristic policies, depending heavily on adversary behavior.
The paper evaluates agents for automated network intrusion response in a cyber range designed for human operator training, featuring variable topology, red-team emulation, and simulated users. Alerts are generated by a SIEM platform and mapped to a data modeling language used by the agents, with reinforcement learning policies optimized to minimize combined defense and availability costs using a cyber attack simulator. Reinforcement learning agents defended the system more efficiently than heuristic policies, with performance highly dependent on the adversary policy and simulated user behavior.