# Quantitative Resilience Modeling for Autonomous Cyber Defense

arXiv: https://arxiv.org/abs/2503.02780 · HTML: https://mlsanity.com/paper/2503.02780/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 30 references that are in the map.
- First posted on arXiv 4 Mar 2025.

## Builds on (most cited first, 11 of 11)

- [CybORG: A Gym for the Development of Autonomous Cyber Agents](https://mlsanity.com/paper/2108.09118/) (2021)
- [On Autonomous Agents in a Cyber Defence Environment](https://mlsanity.com/paper/2309.07388/) (2023)
- [Automated Cyber Defence: A Review](https://mlsanity.com/paper/2303.04926/) (2023)
- [Reinforcement Learning for Feedback-Enabled Cyber Resilience](https://mlsanity.com/paper/2107.00783/) (2021)
- [Learning Cyber Defence Tactics from Scratch with Multi-Agent Reinforcement Learning](https://mlsanity.com/paper/2310.05939/) (2023)
- [Optimal Defender Strategies for CAGE-2 using Causal Modeling and Tree Search](https://mlsanity.com/paper/2407.11070/) (2024)
- [Cyberphysical Security Through Resiliency: A Systems-centric Approach](https://mlsanity.com/paper/2011.14469/) (2020)
- [To Improve Cyber Resilience, Measure It](https://mlsanity.com/paper/2102.09455/) (2021)
- [Cyber-Resilience Evaluation of Cyber-Physical Systems](https://mlsanity.com/paper/2009.06927/) (2020)
- [Multi-Agent Learning for Resilient Distributed Control Systems](https://mlsanity.com/paper/2208.05060/) (2022)
- [Quantitative Measurement of Cyber Resilience: Modeling and Experimentation](https://mlsanity.com/paper/2303.16307/) (2023)

## Built on by (most cited first, 1 of 1)

- [Multi-Agent LLM Governance for Safe Two-Timescale Reinforcement Learning in SDN-IoT Defense](https://mlsanity.com/paper/2604.01127/) (2026)

## Abstract (arXiv)

Cyber resilience is the ability of a system to recover from an attack with minimal impact on system operations. However, characterizing a network's resilience under a cyber attack is challenging, as there are no formal definitions of resilience applicable to diverse network topologies and attack patterns. In this work, we propose a quantifiable formulation of resilience that considers multiple defender operational goals, the criticality of various network resources for daily operations, and provides interpretability to security operators about their system's resilience under attack. We evaluate our approach within the CybORG environment, a reinforcement learning (RL) framework for autonomous cyber defense, analyzing trade-offs between resilience, costs, and prioritization of operational goals. Furthermore, we introduce methods to aggregate resilience metrics across time-variable attack patterns and multiple network topologies, comprehensively characterizing system resilience. Using insights gained from our resilience metrics, we design RL autonomous defensive agents and compare them against several heuristic baselines, showing that proactive network hardening techniques and prompt recovery of compromised machines are critical for effective cyber defenses.