Search papers, labs, and topics across Lattice.
This paper introduces a Policy Learning Technique that leverages imitation learning to enable autonomous cyber-defense agents to predict the actions of partially observable adversarial agents in real-time. By integrating this technique with neurosymbolic approaches, the authors demonstrate that the cyber-defense agents can effectively learn and adapt to various red policies, achieving high prediction accuracy in simulated environments. The findings highlight the potential for improved resilience against sophisticated cyber-attacks through enhanced decision-making capabilities of autonomous agents.
Predicting adversarial actions in cyber-defense can significantly enhance the effectiveness of autonomous agents, achieving high accuracy even in partially observable environments.
With sophisticated cyber-attacks becoming increasingly prevalent, modern networks require intelligent autonomous cyber-defense agents trained via Reinforcement Learning (RL). These agents employ neurosymbolic approaches such as behavior trees with learning-enabled components (LECs) to learn, reason, adapt, and implement security rules while maintaining critical operations. However, these autonomous networks are partially observable systems, i.e., the cyber-attacker's (red agent's) actions are not observable, making it difficult for the defender to predict red actions, learn red policies, or assess the attacker's intrusion levels. To address this, we propose a Policy Learning Technique using imitation learning to learn policies for partially observable RL agents with discrete states and discrete actions. We apply this technique in an autonomous cyber environment to predict red agent's actions from network observations and defender actions. Integrated with a neurosymbolic cyber-defense agent, our method effectively handles different red policies and achieves high prediction accuracy across diverse simulated scenarios.
