# Prospective Artificial Intelligence Approaches for Active Cyber Defence

arXiv: https://arxiv.org/abs/2104.09981 · HTML: https://mlsanity.com/paper/2104.09981/

## Key facts

- Cited by 11 papers in the map (data through 14 Oct 2026).
- Builds on 8 of its 28 references that are in the map.
- First posted on arXiv 20 Apr 2021.

## Builds on (most cited first, 8 of 8)

- [Wild Patterns: Ten Years After the Rise of Adversarial Machine Learning](https://mlsanity.com/paper/1712.03141/) (2017)
- [Deep Reinforcement Learning for Cyber Security](https://mlsanity.com/paper/1906.05799/) (2019)
- [Online Control with Adversarial Disturbances](https://mlsanity.com/paper/1902.08721/) (2019)
- [Finding Effective Security Strategies through Reinforcement Learning and Self-Play](https://mlsanity.com/paper/2009.08120/) (2020)
- [A Stochastic Model of Active Cyber Defense Dynamics](https://mlsanity.com/paper/1603.08309/) (2016)
- [Optimizing Active Cyber Defense](https://mlsanity.com/paper/1603.08312/) (2016)
- [The epidemiology of lateral movement: exposures and countermeasures with network contagion models](https://mlsanity.com/paper/1903.07741/) (2019)
- [Features and Operation of an Autonomous Agent for Cyber Defense](https://mlsanity.com/paper/1905.05253/) (2019)

## Built on by (most cited first, 11 of 11)

- [Developing Optimal Causal Cyber-Defence Agents via Cyber Security Simulation](https://mlsanity.com/paper/2207.12355/) (2022)
- [Automated Cyber Defence: A Review](https://mlsanity.com/paper/2303.04926/) (2023)
- [Intrusion Prevention through Optimal Stopping](https://mlsanity.com/paper/2111.00289/) (2021)
- [Learning Near-Optimal Intrusion Responses Against Dynamic Attackers](https://mlsanity.com/paper/2301.06085/) (2023)
- [Learning Security Strategies through Game Play and Optimal Stopping](https://mlsanity.com/paper/2205.14694/) (2022)
- [A System for Interactive Examination of Learned Security Policies](https://mlsanity.com/paper/2204.01126/) (2022)
- [Using a Collated Cybersecurity Dataset for Machine Learning and Artificial Intelligence](https://mlsanity.com/paper/2108.02618/) (2021)
- [Autonomous Attack Mitigation for Industrial Control Systems](https://mlsanity.com/paper/2111.02445/) (2021)
- [Using Quantum Solved Deep Boltzmann Machines to Increase the Data Efficiency of RL Agents](https://mlsanity.com/paper/2408.17240/) (2024)
- [General Autonomous Cybersecurity Defense: Learning Robust Policies for Dynamic Topologies and Diverse Attackers](https://mlsanity.com/paper/2506.22706/) (2025)
- [Graphical Models for Decision-Making: Integrating Causality and Game Theory](https://mlsanity.com/paper/2504.13210/) (2025)

## Abstract (arXiv)

Cybercriminals are rapidly developing new malicious tools that leverage artificial intelligence (AI) to enable new classes of adaptive and stealthy attacks. New defensive methods need to be developed to counter these threats. Some cybersecurity professionals are speculating AI will enable corresponding new classes of active cyber defence measures -- is this realistic, or currently mostly hype? The Alan Turing Institute, with expert guidance from the UK National Cyber Security Centre and Defence Science Technology Laboratory, published a research roadmap for AI for ACD last year. This position paper updates the roadmap for two of the most promising AI approaches -- reinforcement learning and causal inference - and describes why they could help tip the balance back towards defenders.