Metraipolis › archive › dc_ba20cd0535fc

A Cyber Range Evaluation of Autonomous Network Incident Response Agents — arXiv:2609.16541

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.16541
License (as archived): CC0-1.0
Archived: 2026-10-15T18:35:06.136Z
SHA-256 of the archived text: 974a754b762edf365cbd0d036264d31a6ed3911ea9b2f287f93bf1bc376c6569
Stable URL of this page: https://metraipolis.com/documento/dc_ba20cd0535fc

How to cite

A Cyber Range Evaluation of Autonomous Network Incident Response Agents — arXiv:2609.16541 — arXiv (en), https://arxiv.org/abs/2609.16541 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_ba20cd0535fc (Metraipolis archive dc_ba20cd0535fc, sha256 974a754b762edf365cbd0d036264d31a6ed3911ea9b2f287f93bf1bc376c6569)

BibTeX

@misc{dcba20cd0535fc,
  title = {A Cyber Range Evaluation of Autonomous Network Incident Response Agents — arXiv:2609.16541},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.16541},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_ba20cd0535fc; sha256 974a754b762edf365cbd0d036264d31a6ed3911ea9b2f287f93bf1bc376c6569},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.16541. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

We test the performance of agents for automated network intrusion response in a cyber range intended for human operator training. The range implements an emulated networking environment with a variable network topology, red-team emulation and simulated user agents. The goal of the defensive agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. Alerts are generated using a SIEM platform and mapped to a data modeling language used by the agents. We test a combination of heuristic agents and policies learned using reinforcement learning. The learned policies are optimized to minimize the combined cost using a cyber attack simulator modeling the network. We found that the reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and that the performance depends highly on the policy of the adversary in combination with the simulated users.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-16 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.16541 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-15T18:03:09.660Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-16?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).