Inroads into Autonomous Network Defence using Explained Reinforcement Learning
Not on the map. Why?
Abstract (arXiv)
Computer network defence is a complicated task that has necessitated a high degree of human involvement. However, with recent advancements in machine learning, fully autonomous network defence is becoming increasingly plausible. This paper introduces an end-to-end methodology for studying attack strategies, designing defence agents and explaining their operation. First, using state diagrams, we visualise adversarial behaviour to gain insight about potential points of intervention and inform the design of our defensive models. We opt to use a set of deep reinforcement learning agents trained on different parts of the task and organised in a shallow hierarchy. Our evaluation shows that the resulting design achieves a substantial performance improvement compared to prior work. Finally, to better investigate the decision-making process of our agents, we complete our analysis with a feature ablation and importance study.
Key facts. Cited by 17 papers in the map (data through 14 Oct 2026). Builds on 20 of its 32 references that are in the map. First posted on arXiv 15 Jun 2023.
Builds on
20 of 32 references.
References · 20
- 2017Proximal Policy Optimization Algorithmscited by 15,215
- 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
- 2013Playing Atari with Deep Reinforcement Learningcited by 3,274
- 2016Asynchronous Methods for Deep Reinforcement Learningcited by 2,258
- 2017Curiosity-driven Exploration by Self-supervised Predictioncited by 1,194
- 2019Dota 2 with Large Scale Deep Reinforcement Learningcited by 1,103
- 2021The Surprising Effectiveness of PPO in Cooperative, Multi-Agent Gamescited by 942
- 2017Deep Reinforcement Learning framework for Autonomous Drivingcited by 225
- 2020Explainable Reinforcement Learning: A Surveycited by 141
- 2020Explainability in Deep Reinforcement Learningcited by 97
- 2019Deep Reinforcement Learning for Cyber Securitycited by 95
- 2021CybORG: A Gym for the Development of Autonomous Cyber Agentscited by 60
8 more
- 2022Developing Optimal Causal Cyber-Defence Agents via Cyber Security Simulationcited by 37
- 2020Explainable Face Recognitioncited by 34
- 2021Network Environment Design for Autonomous Cyberdefensecited by 32
- 2021Deep hierarchical reinforcement agents for automated penetration testingcited by 19
- 2018Reinforcement Learning for Autonomous Defence in Software-Defined Networkingcited by 17
- 2021Dynamic Causal Bayesian Optimizationcited by 17
- 2021Learning Intrusion Prevention Policies through Optimal Stoppingcited by 11
- 2022Behaviour-Diverse Automatic Penetration Testing: A Curiosity-Driven Multi-Objective Deep Reinforcement Learning Approachcited by 7
Built on by
Citing papers per year: 2023: 3; 2024: 6; 2025: 4; 2026: 4.
17 papers.
Sort:
By area:
- 2023Reward Shaping for Happier Autonomous Cyber Security Agentscited by 19
- 2024Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Searchcited by 12
- 2024CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agentscited by 11
- 2024Entity-based Reinforcement Learning for Autonomous Cyber Defencecited by 11
- 2023Canaries and Whistles: Resilient Drone Communication Networks with (or without) Deep Reinforcement Learningcited by 9
- 2023Scalable Learning of Intrusion Responses through Recursive Decompositioncited by 8
- 2024Intrusion Tolerance for Networked Systems through Two-Level Feedback Controlcited by 8
- 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Driftcited by 7
- 2025Unveiling the Black Box: A Multi-Layer Framework for Explaining Reinforcement Learning-Based Cyber Agentscited by 4
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
- 2025Learning Optimal Defender Strategies for CAGE-2 using a POMDP Modelcited by 3
- 2026Beyond Rewards in Reinforcement Learning for Cyber Defencecited by 3
5 more
- 2026Building Better Environments for Autonomous Cyber Defencecited by 3
- 2024Multi-Agent Actor-Critics in Autonomous Cyber Defensecited by 2
- 2024Inherently Interpretable and Uncertainty-Aware Models for Online Learning in Cyber-Security Problemscited by 0
- 2025Pruning Cannot Hurt Robustness: Certified Trade-offs in Reinforcement Learningcited by 0
- 2026REPLICANT: Learning Policies for Evading and Hardening Malware Detectorscited by 0
- 2026REPLICANT: Learning Policies for Evading and Hardening Malware Detectors28 Aug 2026
- 2026Building Better Environments for Autonomous Cyber Defence9 Apr 2026
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity9 Feb 2026
- 2026Beyond Rewards in Reinforcement Learning for Cyber Defence4 Feb 2026
- 2025Pruning Cannot Hurt Robustness: Certified Trade-offs in Reinforcement Learning14 Oct 2025
- 2025Learning Optimal Defender Strategies for CAGE-2 using a POMDP Model8 Sep 2025
- 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift26 Aug 2025
- 2025Unveiling the Black Box: A Multi-Layer Framework for Explaining Reinforcement Learning-Based Cyber Agents16 May 2025
- 2024Inherently Interpretable and Uncertainty-Aware Models for Online Learning in Cyber-Security Problems14 Nov 2024
- 2024Entity-based Reinforcement Learning for Autonomous Cyber Defence23 Oct 2024
- 2024CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agents18 Oct 2024
- 2024Multi-Agent Actor-Critics in Autonomous Cyber Defense11 Oct 2024
5 more
- 2024Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search12 Jul 2024
- 2024Intrusion Tolerance for Networked Systems through Two-Level Feedback Control2 Apr 2024
- 2023Canaries and Whistles: Resilient Drone Communication Networks with (or without) Deep Reinforcement Learning8 Dec 2023
- 2023Reward Shaping for Happier Autonomous Cyber Security Agents20 Oct 2023
- 2023Scalable Learning of Intrusion Responses through Recursive Decomposition6 Sep 2023
- 2024CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agentscited by 11
- 2024Entity-based Reinforcement Learning for Autonomous Cyber Defencecited by 11
- 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Driftcited by 7
- 2025Unveiling the Black Box: A Multi-Layer Framework for Explaining Reinforcement Learning-Based Cyber Agentscited by 4
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecuritycited by 4
- 2026Beyond Rewards in Reinforcement Learning for Cyber Defencecited by 3
- 2026Building Better Environments for Autonomous Cyber Defencecited by 3
- 2025Pruning Cannot Hurt Robustness: Certified Trade-offs in Reinforcement Learningcited by 0
- 2026Building Better Environments for Autonomous Cyber Defence9 Apr 2026
- 2026SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity9 Feb 2026
- 2026Beyond Rewards in Reinforcement Learning for Cyber Defence4 Feb 2026
- 2025Pruning Cannot Hurt Robustness: Certified Trade-offs in Reinforcement Learning14 Oct 2025
- 2025DRMD: Deep Reinforcement Learning for Malware Detection under Concept Drift26 Aug 2025
- 2025Unveiling the Black Box: A Multi-Layer Framework for Explaining Reinforcement Learning-Based Cyber Agents16 May 2025
- 2024Entity-based Reinforcement Learning for Autonomous Cyber Defence23 Oct 2024
- 2024CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agents18 Oct 2024
- 2023Reward Shaping for Happier Autonomous Cyber Security Agentscited by 19
- 2024Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Searchcited by 12
- 2023Canaries and Whistles: Resilient Drone Communication Networks with (or without) Deep Reinforcement Learningcited by 9
- 2023Scalable Learning of Intrusion Responses through Recursive Decompositioncited by 8
- 2024Intrusion Tolerance for Networked Systems through Two-Level Feedback Controlcited by 8
- 2025Learning Optimal Defender Strategies for CAGE-2 using a POMDP Modelcited by 3
- 2024Multi-Agent Actor-Critics in Autonomous Cyber Defensecited by 2
- 2024Inherently Interpretable and Uncertainty-Aware Models for Online Learning in Cyber-Security Problemscited by 0
- 2026REPLICANT: Learning Policies for Evading and Hardening Malware Detectorscited by 0
- 2026REPLICANT: Learning Policies for Evading and Hardening Malware Detectors28 Aug 2026
- 2025Learning Optimal Defender Strategies for CAGE-2 using a POMDP Model8 Sep 2025
- 2024Inherently Interpretable and Uncertainty-Aware Models for Online Learning in Cyber-Security Problems14 Nov 2024
- 2024Multi-Agent Actor-Critics in Autonomous Cyber Defense11 Oct 2024
- 2024Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search12 Jul 2024
- 2024Intrusion Tolerance for Networked Systems through Two-Level Feedback Control2 Apr 2024
- 2023Canaries and Whistles: Resilient Drone Communication Networks with (or without) Deep Reinforcement Learning8 Dec 2023
- 2023Reward Shaping for Happier Autonomous Cyber Security Agents20 Oct 2023
- 2023Scalable Learning of Intrusion Responses through Recursive Decomposition6 Sep 2023