Learning Red Agent Policy from Observations for Neurosymbolic Autonomous Cyber Agents

• URL: http://arxiv.org/abs/2606.18223v1
• Date: Tue, 16 Jun 2026 17:50:41 GMT
• Title: Learning Red Agent Policy from Observations for Neurosymbolic Autonomous Cyber Agents
• Abstract summary: Modern networks require intelligent autonomous cyber-defense agents trained via Reinforcement Learning (RL)<n>We propose a Policy Learning Technique using imitation learning to learn policies for partially observable RL agents with discrete states and discrete actions.<n>We apply this technique in an autonomous cyber environment to predict red agent's actions from network observations and defender actions.
• Score: 0.0761187029699472
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: With sophisticated cyber-attacks becoming increasingly prevalent, modern networks require intelligent autonomous cyber-defense agents trained via Reinforcement Learning (RL). These agents employ neurosymbolic approaches such as behavior trees with learning-enabled components (LECs) to learn, reason, adapt, and implement security rules while maintaining critical operations. However, these autonomous networks are partially observable systems, i.e., the cyber-attacker's (red agent's) actions are not observable, making it difficult for the defender to predict red actions, learn red policies, or assess the attacker's intrusion levels. To address this, we propose a Policy Learning Technique using imitation learning to learn policies for partially observable RL agents with discrete states and discrete actions. We apply this technique in an autonomous cyber environment to predict red agent's actions from network observations and defender actions. Integrated with a neurosymbolic cyber-defense agent, our method effectively handles different red policies and achieves high prediction accuracy across diverse simulated scenarios.

Related papers

• A Cyber Range Evaluation of Autonomous Network Incident Response Agents [0.0]
  We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training.<n>The goal of the defensive agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures.
  arXiv  Detail & Related papers  (2026-09-15T02:36:15Z)
• Towards a Multi-Agent Simulation of Cyber-attackers and Cyber-defenders Battles [0.0]
  This paper presents a Markovian modeling and implementation through a simulator of fighting cyber-attacker agents and cyber-defender agents deployed on host network nodes.<n>It aims to provide an experimental framework to implement realistically based coordinated cyber-attack scenarios.
  arXiv  Detail & Related papers  (2025-06-05T10:17:17Z)
• Out-of-Distribution Detection for Neurosymbolic Autonomous Cyber Agents [0.0]
  We develop an out-of-distribution (OOD) Monitoring algorithm that uses a Probabilistic Neural Network (PNN) to detect anomalous situations.<n>We integrate the OOD monitoring algorithm with a neurosymbolic autonomous cyber agent that uses behavior trees with learning-enabled components.
  arXiv  Detail & Related papers  (2024-12-03T22:20:52Z)
• Designing Robust Cyber-Defense Agents with Evolving Behavior Trees [0.0]
  We develop an approach to design autonomous cyber defense agents using behavior trees with learning-enabled components. Learning-enabled components are optimized for adapting to various cyber-attacks and deploying security mechanisms. Our results demonstrate that the EBT-based agent is robust to adaptive cyber-attacks and provides high-level explanations for interpreting its decisions and actions.
  arXiv  Detail & Related papers  (2024-10-21T18:00:38Z)
• Multi-Agent Actor-Critics in Autonomous Cyber Defense [0.5261718469769447]
  Multi-Agent Deep Reinforcement Learning (MADRL) presents a promising approach to enhancing the efficacy and resilience of autonomous cyber operations. We demonstrate each agent is able to learn quickly and counter act on the threats autonomously using MADRL in simulated cyber-attack scenarios.
  arXiv  Detail & Related papers  (2024-10-11T15:15:09Z)
• Investigating Human-Identifiable Features Hidden in Adversarial Perturbations [54.39726653562144]
  Our study explores up to five attack algorithms across three datasets. We identify human-identifiable features in adversarial perturbations. Using pixel-level annotations, we extract such features and demonstrate their ability to compromise target models.
  arXiv  Detail & Related papers  (2023-09-28T22:31:29Z)
• Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDS [70.60975663021952]
  We study blackbox adversarial attacks on network classifiers. We argue that attacker-defender fixed points are themselves general-sum games with complex phase transitions. We show that a continual learning approach is required to study attacker-defender dynamics.
  arXiv  Detail & Related papers  (2021-11-23T23:42:16Z)
• Autonomous Attack Mitigation for Industrial Control Systems [25.894883701063055]
  Defending computer networks from cyber attack requires timely responses to alerts and threat intelligence. We present a deep reinforcement learning approach to autonomous response and recovery in large industrial control networks.
  arXiv  Detail & Related papers  (2021-11-03T18:08:06Z)
• Automating Privilege Escalation with Deep Reinforcement Learning [71.87228372303453]
  In this work, we exemplify the potential threat of malicious actors using deep reinforcement learning to train automated agents. We present an agent that uses a state-of-the-art reinforcement learning algorithm to perform local privilege escalation. Our agent is usable for generating realistic attack sensor data for training and evaluating intrusion detection systems.
  arXiv  Detail & Related papers  (2021-10-04T12:20:46Z)
• The Feasibility and Inevitability of Stealth Attacks [63.14766152741211]
  We study new adversarial perturbations that enable an attacker to gain control over decisions in generic Artificial Intelligence systems. In contrast to adversarial data modification, the attack mechanism we consider here involves alterations to the AI system itself.
  arXiv  Detail & Related papers  (2021-06-26T10:50:07Z)
• Adversarial Machine Learning Attacks and Defense Methods in the Cyber Security Domain [58.30296637276011]
  This paper summarizes the latest research on adversarial attacks against security solutions based on machine learning techniques. It is the first to discuss the unique challenges of implementing end-to-end adversarial attacks in the cyber security domain.
  arXiv  Detail & Related papers  (2020-07-05T18:22:40Z)
• Adversarial vs behavioural-based defensive AI with joint, continual and active learning: automated evaluation of robustness to deception, poisoning and concept drift [62.997667081978825]
  Recent advancements in Artificial Intelligence (AI) have brought new capabilities to behavioural analysis (UEBA) for cyber-security. In this paper, we present a solution to effectively mitigate this attack by improving the detection process and efficiently leveraging human expertise.
  arXiv  Detail & Related papers  (2020-01-13T13:54:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.