arXiv cs.AI· Jakob Nyberg, Teodor Sommestad, Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt·· 11 小时前AI 评分34
用网络靶场评估归纳式自主网络事件响应智能体
A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents
AI 导读
研究将关系数据库建模与强化学习结合，构建可处理可变数量网络资产的归纳式入侵响应智能体，无需重新训练即可适应不同拓扑。在含红队自动化和模拟用户的虚拟网络中测试，强化学习智能体整体防御效率高于启发式策略，且最接近人类操作员表现。
正文 · 原文
Abstract:We have applied a novel combination of classic relational database modeling and modern reinforcement learning to automated intrusion response to enable inductive decision agents. Unlike previous work in the area, our approach allows agents to handle variable quantities of network assets without retraining. We test the operational performance of our approach in a virtualized computer network with variable topologies, red-team automation and simulated user agents. The task of the agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. We test a combination of heuristic agents and policies trained using relational reinforcement learning. The reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and the closest to the performance of human operators at the task.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.16541 [cs.CR] |
| (or arXiv:2609.16541v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.16541 arXiv-issued DOI via DataCite |
Submission history
From: Jakob Nyberg [view email]
[v1]
Tue, 15 Sep 2026 02:36:15 UTC (3,654 KB)
[v2]
Thu, 5 Nov 2026 15:16:02 UTC (681 KB)
来源：arXiv cs.AI · arxiv.org