A Cyber Range Evaluation of Autonomous Network Incident Response Agents
cs.CR, cs.AI
Submitted: 2026-09-15
Updated: 2026-09-15
License: http://creativecommons.org/licenses/by-sa/4.0/
The gist: We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training.
Terminology
Abstract
We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents. The goal of the defensive agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. Alerts are generated using a SIEM platform and mapped to a data modeling language used by the agents. We test a combination of heuristic agents and policies learned using reinforcement learning. The learned policies are optimized to minimize the combined cost using a cyber attack simulator modeling the network. We found that the reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and that the performance depends highly on the policy of the adversary in combination with the simulated users.
Sources
- CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agents
- CSLE: A Reinforcement Learning Platform for Autonomous Security Management
- Building Better Environments for Autonomous Cyber Defence
Related papers
- SoK: AI-Augmented Binary Reversing
- Relaxed Sender Anonymity for CBDC Interbank Settlement: A Zero-Knowledge Approach on Permissioned EVM
- Calibration-Family Overfit: Why Trusted Sabotage Monitors Don't Transfer Across Lineages
- Efficient Fuzzy PSI under One-Sided Assumptions
- Sealing the Audit-Runtime Gap for LLM Skills
- Token Composition: A Graph Based on EVM Logs