Newest papers

Adaptive Cyber-Defense for Evolving Attacker Capabilities using Reinforcement Learning and Behavior Trees

Nicholas Potteiger, Ankita Samaddar, Xenofon Koutsoukos · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25420 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

No entanto, as abordagens existentes podem tornar-se frágeis à medida que as capacidades de ataque evoluem e permitem novas estratégias de ataque. Neste trabalho, estudamos o problema de adaptar as políticas de ataque aprendidas no CAGE Challenge Scenário 2 (CC2), um cenário de defesa de rede empresarial de referência, a um cenário de rede estendido com novas capacidades de comportamento de ataque representadas por novas ações de ataque. Estratégias de ataque eficazes que aproveitam novas ações são inicialmente desconhecidas e, portanto, as políticas de ataque devem ser aprendidas antes que a adaptação de defesa possa ocorrer. Para responder a esse desafio, desenvolvemos o RLAR (LAR) do adversário com árvores de comportamento (ARLBT), que usa políticas de comportamento de recompensa (RBTs) para definir as funções de recompensa base

Machine translation (Meta M2M100); the English original follows.

Abstract

Autonomous cyber-defense agents trained using reinforcement learning (RL) are increasingly adopted for defending enterprise computer networks. However, existing approaches may become brittle as attacker capabilities evolve and enable new attack strategies. In this work, we study the problem of adapting defender policies learned in CAGE Challenge Scenario 2 (CC2), a benchmark enterprise network defense scenario, to an extended network scenario with new attacker capabilities represented by new attacker actions. Effective attack strategies that leverage new actions are initially unknown, and therefore attacker policies must be learned before defender adaptation can occur. To address this challenge, we develop adversarial RL (ARL) with behavior trees (ARLBT), which uses reward behavior trees (RBTs) to define progression-based reward functions and condition attacker policies on RBT execution. The proposed RBT incorporates the new attacker actions into structured attack strategies while leveraging parallel execution to generate rewards across multiple network nodes simultaneously. We evaluate ARLBT for learning attacker policies against two baseline defender policies across network scenarios with different sets of new attacker actions and compare against multiple attacker baselines. The results demonstrate that ARLBT improves attacker success compared to ARL using the original CC2 reward function and that conditioning policies on RBT execution can improve sample efficiency. We further show that defender policies can be adapted against the learned attackers, improving robustness to attacks that leverage new attacker actions.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Reinforcement learning, Computer science, Adversarial system, Leverage (statistics), Computer security, Robustness (evolution)

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange