Learning Cyber Defence Tactics from Scratch with Multi-Agent Reinforcement Learning
This work addresses cyber defense for network security teams, but it is incremental as it applies existing MARL methods to a new domain.
The paper tackled the problem of autonomous cyber defense by using multi-agent reinforcement learning (MARL) to train defender agents in a simulated network environment, resulting in both value-based independent learning and centralized training decentralized execution (CTDE) methods outperforming a simple heuristic defender.
Recent advancements in deep learning techniques have opened new possibilities for designing solutions for autonomous cyber defence. Teams of intelligent agents in computer network defence roles may reveal promising avenues to safeguard cyber and kinetic assets. In a simulated game environment, agents are evaluated on their ability to jointly mitigate attacker activity in host-based defence scenarios. Defender systems are evaluated against heuristic attackers with the goals of compromising network confidentiality, integrity, and availability. Value-based Independent Learning and Centralized Training Decentralized Execution (CTDE) cooperative Multi-Agent Reinforcement Learning (MARL) methods are compared revealing that both approaches outperform a simple multi-agent heuristic defender. This work demonstrates the ability of cooperative MARL to learn effective cyber defence tactics against varied threats.