Deep Reinforcement Learning for Cyber Security
Not on the map. Why?
Abstract (arXiv)
The scale of Internet-connected systems has increased considerably, and these systems are being exposed to cyber attacks more than ever. The complexity and dynamics of cyber attacks require protecting mechanisms to be responsive, adaptive, and scalable. Machine learning, or more specifically deep reinforcement learning (DRL), methods have been proposed widely to address these issues. By incorporating deep learning into traditional RL, DRL is highly capable of solving complex, dynamic, and especially high-dimensional cyber defense problems. This paper presents a survey of DRL approaches developed for cyber security. We touch on different vital aspects, including DRL-based security methods for cyber-physical systems, autonomous intrusion detection techniques, and multiagent DRL-based game theory simulations for defense strategies against cyber attacks. Extensive discussions and future research directions on DRL-based cyber security are also given. We expect that this comprehensive review provides the foundations for and facilitates future studies on exploring the potential of emerging DRL to cope with increasingly complex cyber security problems.
Key facts. Cited by 92 papers in the map (data through 7 Oct 2026). First posted on arXiv 13 Jun 2019.
Builds on
No reference list yet.
Built on by
Citing papers per year: 2021: 17; 2022: 12; 2023: 17; 2024: 18; 2025: 13; 2026: 15.
92 papers.
Sort:
By area:
- 2021Reinforcement Learning for IoT Security: A Comprehensive Surveycited by 21
- 2022The Role of Machine Learning in Cybersecuritycited by 21
- 2023Automated Cyber Defence: A Reviewcited by 19
- 2021Reinforcement Learning for Feedback-Enabled Cyber Resiliencecited by 18
- 2021Intrusion Prevention through Optimal Stoppingcited by 18
- 2023Inroads into Autonomous Network Defence using Explained Reinforcement Learningcited by 17
- 2024Autonomous Network Defence using Reinforcement Learningcited by 14
- 2023Learning Near-Optimal Intrusion Responses Against Dynamic Attackerscited by 13
- 2024Automated Security Response through Online Learning with Adaptive Conjecturescited by 13
- 2023Learning Cyber Defence Tactics from Scratch with Multi-Agent Reinforcement Learningcited by 12
- 2023Real-time Network Intrusion Detection via Decision Transformerscited by 12
- 2021Prospective Artificial Intelligence Approaches for Active Cyber Defencecited by 11
38 more
- 2021Learning Intrusion Prevention Policies through Optimal Stoppingcited by 11
- 2021CyGIL: A Cyber Gym for Training Autonomous Agents over Emulated Network Systemscited by 11
- 2022ATTRITION: Attacking Static Hardware Trojan Detection Techniques Using Reinforcement Learningcited by 11
- 2024Entity-based Reinforcement Learning for Autonomous Cyber Defencecited by 11
- 2023Canaries and Whistles: Resilient Drone Communication Networks with (or without) Deep Reinforcement Learningcited by 9
- 2023Vision-based Learning for Drones: A Surveycited by 9
- 2021Deep Q-Learning based Reinforcement Learning Approach for Network Intrusion Detectioncited by 8
- 2022Discovering Exfiltration Paths Using Reinforcement Learning with Attack Graphscited by 8
- 2023A Multiagent CyberBattleSim for RL Cyber Operation Agentscited by 8
- 2023Impacts and Risk of Generative AI Technology on Cyber Defensecited by 8
- 2024Acceleration for Deep Reinforcement Learning using Parallel and Distributed Computing: A Surveycited by 8
- 2021Machine Learning for Security in Vehicular Networks: A Comprehensive Surveycited by 7
- 2022Execute Order 66: Targeted Data Poisoning for Reinforcement Learningcited by 7
- 2023RLocator: Reinforcement Learning for Bug Localizationcited by 7
- 2024Structural Generalization in Autonomous Cyber Incident Response with Message-Passing Neural Networks and Reinforcement Learningcited by 7
- 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Driftcited by 7
- 2021Network Defense is Not a Gamecited by 6
- 2024Cooperative Backdoor Attack in Decentralized Reinforcement Learning with Theoretical Guaranteecited by 6
- 2025A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomycited by 6
- 2021Incorporating Deception into CyberBattleSim for Autonomous Defensecited by 5
- 2021Automating Privilege Escalation with Deep Reinforcement Learningcited by 5
- 2022Learning Security Strategies through Game Play and Optimal Stoppingcited by 5
- 2022DETERRENT: Detecting Trojans using Reinforcement Learningcited by 5
- 2024Optimizing Cyber Defense in Dynamic Active Directories through Reinforcement Learningcited by 5
- 2025Online Incident Response Planning under Model Misspecification through Bayesian Learning and Belief Quantizationcited by 5
- 2026CSLE: A Reinforcement Learning Platform for Autonomous Security Managementcited by 5
- 2021Constraints Satisfiability Driven Reinforcement Learning for Autonomous Cyber Defensecited by 4
- 2021Deception in Social Learning: A Multi-Agent Reinforcement Learning Perspectivecited by 4
- 2022Deep Reinforcement Learning for Cybersecurity Threat Detection and Protection: A Reviewcited by 4
- 2025Reinforcement Learning with Physics-Informed Symbolic Program Priors for Zero-Shot Wireless Indoor Navigationcited by 4
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
- 2021Reinforcement Learning for Industrial Control Network Cyber Security Orchestrationcited by 3
- 2021Reinforcement Learning for Intelligent Healthcare Systems: A Comprehensive Surveycited by 3
- 2021Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDScited by 3
- 2021Application of Deep Reinforcement Learning to Payment Fraudcited by 3
- 2023Deep Reinforcement Learning for Cyber System Defense under Dynamic Adversarial Uncertaintiescited by 3
- 2023Training Automated Defense Strategies Using Graph-based Cyber Attack Simulationscited by 3
- 2023The Power of MEME: Adversarial Malware Creation with Model-Based Reinforcement Learningcited by 3
50 most cited of 92 All 92 (JSON)
- 2026Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation12 Aug 2026
- 2026STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework10 Aug 2026
- 2026Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning3 Aug 2026
- 2026DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense27 Jul 2026
- 2026COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies29 Jun 2026
- 2026Evolutionary Bilevel Reward Shaping for Generalization in Reinforcement Learning15 Jun 2026
- 2026AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation6 Jun 2026
- 2026CSLE: A Reinforcement Learning Platform for Autonomous Security Management16 Apr 2026
- 2026Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning6 Apr 2026
- 2026Learning Communication Between Heterogeneous Agents in Multi-Agent Reinforcement Learning for Autonomous Cyber Defence17 Mar 2026
- 2026DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns17 Mar 2026
- 2026A Scalable Approach to Solving Simulation-Based Network Security Games18 Feb 2026
38 more
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity9 Feb 2026
- 2026Enhancing Cloud Network Resilience via a Robust LLM-Empowered Multi-Agent Reinforcement Learning Framework12 Jan 2026
- 2026ACDZero: MCTS Agent for Mastering Automated Cyber Defense5 Jan 2026
- 2025Deep Reinforcement Learning for Phishing Detection with Transformer-Based Semantic Features7 Dec 2025
- 2025Large Language Model-Based Reward Design for Deep Reinforcement Learning-Driven Autonomous Cyber Defense20 Nov 2025
- 2025Aligning Large Vision-Language Models by Deep Reinforcement Learning and Direct Preference Optimization8 Sep 2025
- 2025PoolFlip: A Multi-Agent Reinforcement Learning Security Environment for Cyber Defense27 Aug 2025
- 2025Attackers Strike Back? Not Anymore -- An Ensemble of RL Defenders Awakens for APT Detection26 Aug 2025
- 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift26 Aug 2025
- 2025Online Incident Response Planning under Model Misspecification through Bayesian Learning and Belief Quantization20 Aug 2025
- 2025Reinforcement Learning with Physics-Informed Symbolic Program Priors for Zero-Shot Wireless Indoor Navigation27 Jun 2025
- 2025TooBadRL: Trigger Optimization to Boost Effectiveness of Backdoor Attacks on Deep Reinforcement Learning11 Jun 2025
- 2025A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy29 May 2025
- 2025MInCo: Mitigating Information Conflicts in Distracted Visual Model-based Reinforcement Learning5 Apr 2025
- 2025Human-AI Collaboration in Cloud Security: Cognitive Hierarchy-Driven Deep Reinforcement Learning22 Feb 2025
- 2025Communication Strategy on Macro-and-Micro Traffic State in Cooperative Deep Reinforcement Learning for Regional Traffic Signal Control18 Feb 2025
- 2024Towards Type Agnostic Cyber Defense Agents2 Dec 2024
- 2024Adaptive Anomaly Detection for Identifying Attacks in Cyber-Physical Systems: A Systematic Literature Review21 Nov 2024
- 2024Acceleration for Deep Reinforcement Learning using Parallel and Distributed Computing: A Survey8 Nov 2024
- 2024Exploring reinforcement learning for incident response in autonomous military vehicles28 Oct 2024
- 2024Entity-based Reinforcement Learning for Autonomous Cyber Defence23 Oct 2024
- 2024A Novel Reinforcement Learning Model for Post-Incident Malware Investigations19 Oct 2024
- 2024Autonomous Network Defence using Reinforcement Learning26 Sep 2024
- 2024A Survey for Deep Reinforcement Learning Based Network Intrusion Detection25 Sep 2024
- 2024Artificial Intelligence for Secured Information Systems in Smart Cities: Collaborative IoT Computing with Deep Reinforcement Learning and Blockchain24 Sep 2024
- 2024Cyber Deception: State of the art, Trends and Open challenges11 Sep 2024
- 2024Distributed Stackelberg Strategies in State-based Potential Games for Autonomous Decentralized Learning Manufacturing Systems12 Aug 2024
- 2024Structural Generalization in Autonomous Cyber Incident Response with Message-Passing Neural Networks and Reinforcement Learning8 Jul 2024
- 2024Optimizing Cyber Defense in Dynamic Active Directories through Reinforcement Learning28 Jun 2024
- 2024Knowledge-Informed Auto-Penetration Testing Based on Reinforcement Learning with Reward Machine24 May 2024
- 2024Cooperative Backdoor Attack in Decentralized Reinforcement Learning with Theoretical Guarantee24 May 2024
- 2024Automated Security Response through Online Learning with Adaptive Conjectures19 Feb 2024
- 2024Discovering Command and Control (C2) Channels on Tor and Public Networks Using Reinforcement Learning14 Feb 2024
- 2024Discovering Command and Control Channels Using Reinforcement Learning13 Jan 2024
- 2023Multi-Agent Reinforcement Learning for Assessing False-Data Injection Attacks on Transportation Networks22 Dec 2023
- 2023Real-time Network Intrusion Detection via Decision Transformers12 Dec 2023
- 2023Vision-based Learning for Drones: A Survey8 Dec 2023
- 2023Canaries and Whistles: Resilient Drone Communication Networks with (or without) Deep Reinforcement Learning8 Dec 2023
50 newest of 92 All 92 (JSON)
- 2026Enhancing Cloud Network Resilience via a Robust LLM-Empowered Multi-Agent Reinforcement Learning Frameworkcited by 1
- 2026Agentic Incident Response through Digital Twin-Enhanced Multiscale Planningcited by 1
- 2026STAIR: Effective Incident Response Using an End-to-End Agentic Planning Frameworkcited by 1
- 2026STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework10 Aug 2026
- 2026Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning3 Aug 2026
- 2026Enhancing Cloud Network Resilience via a Robust LLM-Empowered Multi-Agent Reinforcement Learning Framework12 Jan 2026
- 2021Reinforcement Learning for IoT Security: A Comprehensive Surveycited by 21
- 2022The Role of Machine Learning in Cybersecuritycited by 21
- 2023Automated Cyber Defence: A Reviewcited by 19
- 2021Reinforcement Learning for Feedback-Enabled Cyber Resiliencecited by 18
- 2021Intrusion Prevention through Optimal Stoppingcited by 18
- 2023Inroads into Autonomous Network Defence using Explained Reinforcement Learningcited by 17
- 2024Autonomous Network Defence using Reinforcement Learningcited by 14
- 2023Learning Near-Optimal Intrusion Responses Against Dynamic Attackerscited by 13
- 2024Automated Security Response through Online Learning with Adaptive Conjecturescited by 13
- 2023Learning Cyber Defence Tactics from Scratch with Multi-Agent Reinforcement Learningcited by 12
- 2023Real-time Network Intrusion Detection via Decision Transformerscited by 12
- 2021Prospective Artificial Intelligence Approaches for Active Cyber Defencecited by 11
12 most cited of 86 All 86 (JSON)
- 2026Machine Learning-Based Cyber Defense for Cloud Infrastructure: An Adaptive Deep Q-Network Architecture for Intelligent Intrusion Detection and Automated Threat Mitigation12 Aug 2026
- 2026DeepFaith: Evidence-Grounded LLMs for Faithful Incident Reporting in Multi-Stage APT Defense27 Jul 2026
- 2026COHORT: Collaborative Orchestration for Hardening via Offensive Replay on Emulated Topologies29 Jun 2026
- 2026Evolutionary Bilevel Reward Shaping for Generalization in Reinforcement Learning15 Jun 2026
- 2026AI-Native Closed-Loop Security for 6G-Enabled Cyber-Physical Systems: From Edge Detection to Network-Wide Mitigation6 Jun 2026
- 2026CSLE: A Reinforcement Learning Platform for Autonomous Security Management16 Apr 2026
- 2026Explainable Autonomous Cyber Defense using Adversarial Multi-Agent Reinforcement Learning6 Apr 2026
- 2026Learning Communication Between Heterogeneous Agents in Multi-Agent Reinforcement Learning for Autonomous Cyber Defence17 Mar 2026
- 2026DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns17 Mar 2026
- 2026A Scalable Approach to Solving Simulation-Based Network Security Games18 Feb 2026
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity9 Feb 2026
- 2026ACDZero: MCTS Agent for Mastering Automated Cyber Defense5 Jan 2026
12 newest of 86 All 86 (JSON)