# Autonomous Intelligent Cyber-defense Agent (AICA) Reference Architecture. Release 2.0

arXiv: https://arxiv.org/abs/1803.10664 · HTML: https://mlsanity.com/paper/1803.10664/

## Key facts

- Cited by 8 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 28 Mar 2018.

## Built on by (most cited first, 8 of 8)

- [Automated Cyber Defence: A Review](https://mlsanity.com/paper/2303.04926/) (2023)
- [Deep Reinforcement Learning for Autonomous Cyber Defence: A Survey](https://mlsanity.com/paper/2310.07745/) (2023)
- [Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning](https://mlsanity.com/paper/2604.04442/) (2026)
- [Cybertrust: From Explainable to Actionable and Interpretable AI (AI2)](https://mlsanity.com/paper/2201.11117/) (2022)
- [IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defense](https://mlsanity.com/paper/2411.15672/) (2024)
- [Multi-Agent Reinforcement Learning in Cybersecurity: From Fundamentals to Applications](https://mlsanity.com/paper/2505.19837/) (2025)
- [REGARD: Rules of EngaGement for Automated cybeR Defense to aid in Intrusion Response](https://mlsanity.com/paper/2305.13967/) (2023)
- [A cybersecurity AI agent selection and decision support framework](https://mlsanity.com/paper/2510.01751/) (2025)

## Abstract (arXiv)

This report - a major revision of its previous release - describes a reference architecture for intelligent software agents performing active, largely autonomous cyber-defense actions on military networks of computing and communicating devices. The report is produced by the North Atlantic Treaty Organization (NATO) Research Task Group (RTG) IST-152 "Intelligent Autonomous Agents for Cyber Defense and Resilience". In a conflict with a technically sophisticated adversary, NATO military tactical networks will operate in a heavily contested battlefield. Enemy software cyber agents - malware - will infiltrate friendly networks and attack friendly command, control, communications, computers, intelligence, surveillance, and reconnaissance and computerized weapon systems. To fight them, NATO needs artificial cyber hunters - intelligent, autonomous, mobile agents specialized in active cyber defense. With this in mind, in 2016, NATO initiated RTG IST-152. Its objective has been to help accelerate the development and transition to practice of such software agents by producing a reference architecture and technical roadmap. This report presents the concept and architecture of an Autonomous Intelligent Cyber-defense Agent (AICA). We describe the rationale of the AICA concept, explain the methodology and purpose that drive the definition of the AICA Reference Architecture, and review some of the main features and challenges of AICAs.