CyberWorld：用于样本高效自主网络防御的世界模型
CyberWorld: World Models for Sample-Efficient Autonomous Cyber Defense
浏览论文内容
中文总结 AI 辅助
本文提出CyberWorld，一种基于Dreamer风格的世界模型框架，通过学习网络潜在动力学实现样本高效的自主网络防御，在CyberWheel攻击中显著优于无模型PPO，并验证了图表示对鲁棒性和可扩展性的关键作用。
中文摘要 AI 辅助
深度强化学习已成为自主网络防御的一种重要方法。现有方法主要基于无模型，因此需要大量的环境交互。世界模型提供了一种替代方案，通过学习预测动力学并通过想象轨迹优化策略，在机器人和具身控制中实现了样本效率的大幅提升。将这一范式扩展到网络安全引发了一个基本问题：在网络世界模型中，“世界”应该由什么构成？我们提出了CyberWorld，一个Dreamer风格的世界建模框架，它从被防御网络的向量、图、文本和多模态表示中学习潜在的网络动力学。在所有四种可评分的CyberWheel攻击策略中，基于图的CyberWorld变体在3.6k-15.8k环境步数内超过了策略无关的控制基线，而无模型PPO则需要数百万步。在表示选择方面，图结构在拓扑相关攻击下提供了更强的鲁棒性，而更简单的表示在整体性能上仍具有竞争力。在成功的运行中，当网络规模从15台主机增加到100台主机时，达到控制所需的回合数大致保持不变。这些结果确立了学习到的网络动力学作为自主防御的样本高效且可扩展的基础，并将世界表示确定为鲁棒性和可扩展性的核心设计轴。
英文摘要
Deep reinforcement learning has become a prominent approach to autonomous cyber defense. Existing methods are predominantly model-free and consequently require extensive environment interaction. World models provide an alternative by learning predictive dynamics and optimizing policies through imagined trajectories, yielding substantial gains in sample efficiency in robotics and embodied control. Extending this paradigm to cybersecurity raises a fundamental question: what should constitute the "world" in a cyber world model? We introduce CyberWorld, a Dreamer-style world modeling framework that learns latent cyber dynamics from vector, graph, textual, and multimodal representations of the defended network. Across all four scoreable CyberWheel attack strategies, the graph-based CyberWorld variant exceeds a strategy-agnostic control after 3.6k-15.8k environment steps, compared with millions of steps required by model-free PPO. Across representation choices, graph structure provides greater robustness under topology-dependent attacks, while simpler representations remain competitive in overall performance. Among successful runs, the number of episodes required to reach the control remains approximately constant as network size increases from 15 to 100 hosts. These results establish learned cyber dynamics as a sample-efficient and scalable basis for autonomous defense, and identify world representation as a central design axis for robustness and scalability.
