# Deep Reinforcement Learning for Cyber System Defense under Dynamic Adversarial Uncertainties

arXiv: https://arxiv.org/abs/2302.01595 · HTML: https://mlsanity.com/paper/2302.01595/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 5 of its 26 references that are in the map.
- First posted on arXiv 3 Feb 2023.

## Builds on (most cited first, 5 of 5)

- [OpenAI Gym](https://mlsanity.com/paper/1606.01540/) (2016)
- [Challenges of Real-World Reinforcement Learning](https://mlsanity.com/paper/1904.12901/) (2019)
- [Deep Reinforcement Learning for Cyber Security](https://mlsanity.com/paper/1906.05799/) (2019)
- [POMDPs Make Better Hackers: Accounting for Uncertainty in Penetration Testing](https://mlsanity.com/paper/1307.8182/) (2013)
- [Constraints Satisfiability Driven Reinforcement Learning for Autonomous Cyber Defense](https://mlsanity.com/paper/2104.08994/) (2021)

## Built on by (most cited first, 3 of 3)

- [Towards Production-Worthy Simulation for Autonomous Cyber Operations](https://mlsanity.com/paper/2508.19278/) (2025)
- [Large Language Model-Based Reward Design for Deep Reinforcement Learning-Driven Autonomous Cyber Defense](https://mlsanity.com/paper/2511.16483/) (2025)
- [CyberWorld: World Models for Sample-Efficient Autonomous Cyber Defense](https://mlsanity.com/paper/2609.31893/) (2026)

## Abstract (arXiv)

Development of autonomous cyber system defense strategies and action recommendations in the real-world is challenging, and includes characterizing system state uncertainties and attack-defense dynamics. We propose a data-driven deep reinforcement learning (DRL) framework to learn proactive, context-aware, defense countermeasures that dynamically adapt to evolving adversarial behaviors while minimizing loss of cyber system operations. A dynamic defense optimization problem is formulated with multiple protective postures against different types of adversaries with varying levels of skill and persistence. A custom simulation environment was developed and experiments were devised to systematically evaluate the performance of four model-free DRL algorithms against realistic, multi-stage attack sequences. Our results suggest the efficacy of DRL algorithms for proactive cyber defense under multi-stage attack profiles and system uncertainties.