# Incorporating Deception into CyberBattleSim for Autonomous Defense

arXiv: https://arxiv.org/abs/2108.13980 · HTML: https://mlsanity.com/paper/2108.13980/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 29 references that are in the map.
- First posted on arXiv 31 Aug 2021.

## Builds on (most cited first, 5 of 5)

- [AI Safety Gridworlds](https://mlsanity.com/paper/1711.09883/) (2017)
- [Deep Reinforcement Learning for Cyber Security](https://mlsanity.com/paper/1906.05799/) (2019)
- [Network Defense is Not a Game](https://mlsanity.com/paper/2104.10262/) (2021)
- [Demystifying Deception Technology:A Survey](https://mlsanity.com/paper/1804.06196/) (2018)
- [Strategic Learning for Active, Adaptive, and Autonomous Cyber Defense](https://mlsanity.com/paper/1907.01396/) (2019)

## Built on by (most cited first, 5 of 5)

- [Automated Cyber Defence: A Review](https://mlsanity.com/paper/2303.04926/) (2023)
- [A Multiagent CyberBattleSim for RL Cyber Operation Agents](https://mlsanity.com/paper/2304.11052/) (2023)
- [Deep Reinforcement Learning for Autonomous Cyber Defence: A Survey](https://mlsanity.com/paper/2310.07745/) (2023)
- [Automated Cyber Defense with Generalizable Graph-based Reinforcement Learning Agents](https://mlsanity.com/paper/2509.16151/) (2025)
- [The Path To Autonomous Cyber Defense](https://mlsanity.com/paper/2404.10788/) (2024)

## Abstract (arXiv)

Deceptive elements, including honeypots and decoys, were incorporated into the Microsoft CyberBattleSim experimentation and research platform. The defensive capabilities of the deceptive elements were tested using reinforcement learning based attackers in the provided capture the flag environment. The attacker's progress was found to be dependent on the number and location of the deceptive elements. This is a promising step toward reproducibly testing attack and defense algorithms in a simulated enterprise network with deceptive defensive elements.