Development of autonomous cyber system defense strategies and action recommendations in the real-world is challenging, and includes characterizing system state uncertainties and attack-defense dynamics. We propose a data-driven deep reinforcement learning (DRL) framework to learn proactive, context-aware, defense countermeasures that dynamically adapt to evolving adversarial behaviors while minimizing loss of cyber system operations. A dynamic defense optimization problem is formulated with multiple protective postures against different types of adversaries with varying levels of skill and persistence. A custom simulation environment was developed and experiments were devised to systematically evaluate the performance of four model-free DRL algorithms against realistic, multi-stage attack sequences. Our results suggest the efficacy of DRL algorithms for proactive cyber defense under multi-stage attack profiles and system uncertainties.
Command and Control Engineering College, Army Engineering University of PLA（中国人民解放军陆军工程大学指挥控制工程学院）；troop of PLA（中国人民解放军31436部队）；Academy of Military Science（军事科学院）
The existing network attack and defense method can be regarded as game, but most of the game only involves network domain, not multiple domain cyberspace. To address this challenge, this paper proposed a multiple domain cyberspace attack and defense game model based on reinforcement learning. We define the multiple domain cyberspace include physical domain, network domain and digital domain. By establishing two agents, representing the attacker and the defender respectively, defender will select the multiple domain actions in the multiple domain cyberspace to obtain defender's optimal reward b…
Naval Information Warfare Center Pacific（太平洋海军信息战中心）；Laboratory for Advanced Cybersecurity Research（高级网络安全研究实验室）
Deceptive elements, including honeypots and decoys, were incorporated into the Microsoft CyberBattleSim experimentation and research platform. The defensive capabilities of the deceptive elements were tested using reinforcement learning based attackers in the provided capture the flag environment. The attacker's progress was found to be dependent on the number and location of the deceptive elements. This is a promising step toward reproducibly testing attack and defense algorithms in a simulated enterprise network with deceptive defensive elements.
University of North Carolina Charlotte（北卡罗来纳大学夏洛特分校）；Carnegie Mellon University（卡内基梅隆大学）；Pacific Northwest National Laboratory（太平洋西北国家实验室）
With the increasing system complexity and attack sophistication, the necessity of autonomous cyber defense becomes vivid for cyber and cyber-physical systems (CPSs). Many existing frameworks in the current state-of-the-art either rely on static models with unrealistic assumptions, or fail to satisfy the system safety and security requirements. In this paper, we present a new hybrid autonomous agent architecture that aims to optimize and verify defense policies of reinforcement learning (RL) by incorporating constraints verification (using satisfiability modulo theory (SMT)) into the agent's de…
Multi-Agent Reinforcement Learning in Cybersecurity: From Fundamentals to Applications
Cyber-Defence Campus & Eastern Switzerland University of Applied Sciences（网络安全校园与东瑞士应用科学大学）；Institute for Computational Engineering（计算工程研究所）；armasuisse Science and Technology（armasuisse科技）
CyberArena: Benchmarking AI Agents in Live Symmetric Attack-and-Defense Combat
AI Open Source Foundation（2077AI开源基金会）；UC Santa Cruz（加州大学圣克鲁兹分校）；UC Berkeley（加州大学伯克利分校）；UC Santa Barbara（加州大学圣巴巴拉分校）；University of Wisconsin–Madison（威斯康星大学麦迪逊分校）；Massachusetts Institute of Technology（麻省理工学院）；University of Toronto（多伦多大学）；Johns Hopkins University（约翰斯·霍普金斯大学）；Carnegie Mellon University（卡内基梅隆大学）；Purdue University（普渡大学）；Texas A&M University（德克萨斯农工大学）
The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyber attacks more than ever. The complexity and dynamics of cyber attacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning (DRL), methods have been proposed widely to address these issues. By incorporating deep learning into traditional RL, DRL is highly capable of solving complex, dynamic, and especially high-dimensional cyber defense problems. This paper presents a survey of DRL approaches develop…
Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation
Wilmington University（威尔明顿大学）；Washington University of Science and Technology（华盛顿科技大学）；South Dakota School of Mines & Technology（南达科他矿业理工学院）；South Dakota State University（南达科他州立大学）；St. Francis College（圣弗朗西斯学院）；Stanton University（斯坦顿大学）
Naval Information Warfare Center Pacific（太平洋海军信息战中心）；Laboratory for Advanced Cybersecurity Research（高级网络安全研究实验室）
The performance of artificial intelligence (AI) algorithms in practice depends on the realism and correctness of the data, models, and feedback (labels or rewards) provided to the algorithm. This paper discusses methods for improving the realism and ecological validity of AI used for autonomous cyber defense by exploring the potential to use Inverse Reinforcement Learning (IRL) to gain insight into attacker actions, utilities of those actions, and ultimately decision points which cyber deception could thwart. The Tularosa study, as one example, provides experimental data of real-world techniqu…
DCI-Solutions；U.S. Army Combat Capabilities Development Command (CCDC), C5ISR Center（美国陆军作战能力发展司令部（CCDC）C5ISR中心）
There has been considerable and growing interest in applying machine learning for cyber defenses. One promising approach has been to apply natural language processing techniques to analyze logs data for suspicious behavior. A natural question arises to how robust these systems are to adversarial attacks. Defense against sophisticated attack is of particular concern for cyber defenses. In this paper, we develop a testing framework to evaluate adversarial robustness of machine learning cyber defenses, particularly those focused on log data. Our framework uses techniques from deep reinforcement l…
In recent years machine learning algorithms, and more specifically deep learning algorithms, have been widely used in many fields, including cyber security. However, machine learning systems are vulnerable to adversarial attacks, and this limits the application of machine learning, especially in non-stationary, adversarial environments, such as the cyber security domain, where actual adversaries (e.g., malware developers) exist. This paper comprehensively summarizes the latest research on adversarial attacks against security solutions based on machine learning techniques and illuminates the ri…
Enhancing Network Resilience through Machine Learning-powered Graph Combinatorial Optimization: Applications in Cyber Defense and Information Diffusion
Learning to Defend by Attacking (and Vice-Versa): Transfer of Learning in Cybersecurity Games
Carnegie Mellon University（卡内基梅隆大学）；Social and Decision Sciences Department（社会与决策科学系）；dept. Social and Decision Sciences（社会与决策科学系）；dept. Software and Societal Systems（软件与社会系统系）
College of Computer Science and Technology, Zhejiang University（浙江大学计算机科学与技术学院）
As the number of cyber-attacks is increasing, cybersecurity is evolving to a key concern for any business. Artificial Intelligence (AI) and Machine Learning (ML) (in particular Deep Learning - DL) can be leveraged as key enabling technologies for cyber-defense, since they can contribute in threat detection and can even provide recommended actions to cyber analysts. A partnership of industry, academia, and government on a global scale is necessary in order to advance the adoption of AI/ML to cybersecurity and create efficient cyber defense systems. In this paper, we are concerned with the inves…
ACDZero: MCTS Agent for Mastering Automated Cyber Defense
Dept of ECE, George Washington University（电子工程系，乔治华盛顿大学）；Dept of ECE, Northeastern University（电子工程系，东北大学）；Dept of EECS, United States Military Academy（电子工程与科学系，美国军事学院）
armasuisse S+T（瑞士国防采购与技术局 科学与技术部）；HES-SO Valais-Wallis（瑞士西部高等专业学院 瓦莱州立分校）；Effixis SA（Effixis公司）；University of Lausanne（洛桑大学）；EPFL（洛桑联邦理工学院）
Generative Language Models gained significant attention in late 2022 / early 2023, notably with the introduction of models refined to act consistently with users' expectations of interactions with AI (conversational models). Arguably the focal point of public attention has been such a refinement of the GPT3 model -- the ChatGPT and its subsequent integration with auxiliary capabilities, including search as part of Microsoft Bing. Despite extensive prior research invested in their development, their performance and applicability to a range of daily tasks remained unclear and niche. However, the…
University of Modena and Reggio Emilia（摩德纳和雷焦艾米利亚大学）
Machine learning algorithms are effective in several applications, but they are not as much successful when applied to intrusion detection in cyber security. Due to the high sensitivity to their training data, cyber detectors based on machine learning are vulnerable to targeted adversarial attacks that involve the perturbation of initial samples. Existing defenses assume unrealistic scenarios; their results are underwhelming in non-adversarial settings; or they can be applied only to machine learning algorithms that perform poorly for cyber security. We present an original methodology for coun…
