arXiv cs.AI· Jakob Nyberg, Teodor Sommestad, Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt·· 4 小时前AI 评分30
自主网络事件响应智能体的网络靶场评估
A Cyber Range Evaluation of Inductive Autonomous Network Incident Response Agents
AI 导读
一项 arXiv 研究将经典关系数据库建模与强化学习结合，用于自动入侵响应的归纳式决策智能体，使其无需重新训练即可应对数量可变的网络资产。研究在具有可变拓扑、红队自动化和模拟用户智能体的虚拟化网络中测试，任务是阻止红队访问主机并最小化防御措施带来的可用性成本。结果显示强化学习智能体整体上比启发式策略更高效防守，且最接近人类操作员的表现。
正文 · 原文
Abstract:We have applied a novel combination of classic relational database modeling and modern reinforcement learning to automated intrusion response to enable inductive decision agents. Unlike previous work in the area, our approach allows agents to handle variable quantities of network assets without retraining. We test the operational performance of our approach in a virtualized computer network with variable topologies, red-team automation and simulated user agents. The task of the agents is to prevent hosts in the network from being accessed by the red-team agent, while minimizing the availability costs induced from defensive measures. We test a combination of heuristic agents and policies trained using relational reinforcement learning. The reinforcement learning agents were overall more efficient at defending the system than the heuristic policy, and the closest to the performance of human operators at the task.
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2609.16541 [cs.CR] |
| (or arXiv:2609.16541v2 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2609.16541 arXiv-issued DOI via DataCite |
Submission history
From: Jakob Nyberg [view email]
[v1]
Tue, 15 Sep 2026 02:36:15 UTC (3,654 KB)
[v2]
Thu, 5 Nov 2026 15:16:02 UTC (681 KB)
来源：arXiv cs.AI · arxiv.org