Scholarlink

The escalating sophistication and frequency of cyber threats necessitate a paradigm shift from traditional rule-based defensive mechanisms to intelligent, adaptive systems. Intelligent and autonomous defense mechanisms are critical as attackers adopt more dynamic, evasive, and automated techniques. This paper addresses the gap in current cybersecurity practices by investigating the use of Autonomous Cyber Defense Agents, specifically those empowered by Reinforcement Learning (RL), to enable dynamic and responsive Incident Response (IR) capabilities. RL provides a framework for agents to learn optimal defense strategies through iterative interactions with simulated environments, enabling real-time adaptation to novel threats. By designing and using realistic, simulated cyber environments for training, organizations can equip RL agents with the capabilities required for proactive threat detection, decision-making, and response execution. This research evaluates an existing cybersecurity simulator, Cyberwheel, implements and trains RL algorithms for defensive strategies, and analyzes their effectiveness in detecting and mitigating simulated cyber threats. The key findings highlight that although Q-Learning offers faster training times compared to DQN and PPO, PPO consistently achieves superior performance, attaining the highest cumulative rewards.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

From Rules to Autonomy: Leveraging Reinforcement Learning for Real-Time Cyber Threat Mitigation

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Safa Ouerchfani,
  • Rui Fernandes,
  • Óscar Ribeiro,
  • Monia Najjar,
  • Nuno Lopes

摘要

The escalating sophistication and frequency of cyber threats necessitate a paradigm shift from traditional rule-based defensive mechanisms to intelligent, adaptive systems. Intelligent and autonomous defense mechanisms are critical as attackers adopt more dynamic, evasive, and automated techniques. This paper addresses the gap in current cybersecurity practices by investigating the use of Autonomous Cyber Defense Agents, specifically those empowered by Reinforcement Learning (RL), to enable dynamic and responsive Incident Response (IR) capabilities. RL provides a framework for agents to learn optimal defense strategies through iterative interactions with simulated environments, enabling real-time adaptation to novel threats. By designing and using realistic, simulated cyber environments for training, organizations can equip RL agents with the capabilities required for proactive threat detection, decision-making, and response execution. This research evaluates an existing cybersecurity simulator, Cyberwheel, implements and trains RL algorithms for defensive strategies, and analyzes their effectiveness in detecting and mitigating simulated cyber threats. The key findings highlight that although Q-Learning offers faster training times compared to DQN and PPO, PPO consistently achieves superior performance, attaining the highest cumulative rewards.