# Human-AI Collaboration in Cloud Security: Cognitive Hierarchy-Driven Deep Reinforcement Learning

arXiv: https://arxiv.org/abs/2502.16054 · HTML: https://mlsanity.com/paper/2502.16054/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Placed in Adversarial robustness and RL in finance, one of 15 directions in Deep reinforcement learning methods.
- Builds on 7 of its 38 references that are in the map.
- First posted on arXiv 22 Feb 2025.

## Placed in

- Deep reinforcement learning methods / [Adversarial robustness and RL in finance](https://mlsanity.com/deeprl/adversarial-robustness-and-rl-in-finance/)

## Builds on (most cited first, 7 of 7)

- [Deep Reinforcement Learning for Cyber Security](https://mlsanity.com/paper/1906.05799/) (2019)
- [A2C: A Modular Multi-stage Collaborative Decision Framework for Human-AI Teams](https://mlsanity.com/paper/2401.14432/) (2024)
- [A Game of Drones: Cyber-Physical Security of Time-Critical UAV Applications with Cumulative Prospect Theory Perceptions and Valuations](https://mlsanity.com/paper/1902.03506/) (2019)
- [Defense Against Advanced Persistent Threats in Dynamic Cloud Storage: A Colonel Blotto Game Approach](https://mlsanity.com/paper/1801.06270/) (2018)
- [Learning About Simulated Adversaries from Human Defenders using Interactive Cyber-Defense Games](https://mlsanity.com/paper/2304.01142/) (2023)
- [SAGE: Intrusion Alert-driven Attack Graph Extractor](https://mlsanity.com/paper/2107.02783/) (2021)
- [Planning Distributed Security Operations Centers in Multi-Cloud Landscapes: A Case Study](https://mlsanity.com/paper/2303.03141/) (2023)

## Built on by (most cited first, 1 of 1)

- [Mental Accounts for Actions: EWA-Inspired Attention in Decision Transformers](https://mlsanity.com/paper/2509.15498/) (2025)

## Abstract (arXiv)

Given the complexity of multi-tenant cloud environments and the growing need for real-time threat mitigation, Security Operations Centers (SOCs) must adopt AI-driven adaptive defense mechanisms to counter Advanced Persistent Threats (APTs). However, SOC analysts face challenges in handling adaptive adversarial tactics, requiring intelligent decision-support frameworks. We propose a Cognitive Hierarchy Theory-driven Deep Q-Network (CHT-DQN) framework that models interactive decision-making between SOC analysts and AI-driven APT bots. The SOC analyst (defender) operates at cognitive level-1, anticipating attacker strategies, while the APT bot (attacker) follows a level-0 policy. By incorporating CHT into DQN, our framework enhances adaptive SOC defense using Attack Graph (AG)-based reinforcement learning. Simulation experiments across varying AG complexities show that CHT-DQN consistently achieves higher data protection and lower action discrepancies compared to standard DQN. A theoretical lower bound further confirms its superiority as AG complexity increases. A human-in-the-loop (HITL) evaluation on Amazon Mechanical Turk (MTurk) reveals that SOC analysts using CHT-DQN-derived transition probabilities align more closely with adaptive attackers, leading to better defense outcomes. Moreover, human behavior aligns with Prospect Theory (PT) and Cumulative Prospect Theory (CPT): participants are less likely to reselect failed actions and more likely to persist with successful ones. This asymmetry reflects amplified loss sensitivity and biased probability weighting -- underestimating gains after failure and overestimating continued success. Our findings highlight the potential of integrating cognitive models into deep reinforcement learning to improve real-time SOC decision-making for cloud security.