Automated Cyber Defence: A Review

2023/03/08 by Sanyam Vyas, Vyas, Sanyam, John Hannay +5 · 9 citations
Computer Science · #Advanced Malware Detection Techniques #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Information and Cyber Security #Network Security and Intrusion Detection

paper · pdf · doi:10.48550/arxiv.2303.04926

openalex publication_date 2023/03/08 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28

Abstract

Within recent times, cybercriminals have curated a variety of organised and resolute cyber attacks within a range of cyber systems, leading to consequential ramifications to private and governmental institutions. Current security-based automation and orchestrations focus on automating fixed purpose and hard-coded solutions, which are easily surpassed by modern-day cyber attacks. Research within Automated Cyber Defence will allow the development and enabling intelligence response by autonomously defending networked systems through sequential decision-making agents. This article comprehensively elaborates the developments within Automated Cyber Defence through a requirement analysis divided into two sub-areas, namely, automated defence and attack agents and Autonomous Cyber Operation (ACO) Gyms. The requirement analysis allows the comparison of automated agents and highlights the importance of ACO Gyms for their continual development. The requirement analysis is also used to critique ACO Gyms with an overall aim to develop them for deploying automated agents within real-world networked systems. Relevant future challenges were addressed from the overall analysis to accelerate development within the area of Automated Cyber Defence.

Cited by

• Open Security Benchmark: Towards Autonomous Enterprise Cyber Defense
• Automated Cyber Defense with Generalizable Graph-based Reinforcement Learning Agents
• Strategic Cyber Defense via Reinforcement Learning-Guided Combinatorial Auctions
• Learning Optimal Defender Strategies for CAGE-2 using a POMDP Model
• Incident Response Planning Using a Lightweight Large Language Model with Reduced Hallucination
• Adaptive Network Security Policies via Belief Aggregation and Rollout
• Toward an Intent-Based and Ontology-Driven Autonomic Security Response in Security Orchestration Automation and Response
• Interpreting Agent Behaviors in Reinforcement-Learning-Based Cyber-Battle Simulation Platforms
• General Autonomous Cybersecurity Defense: Learning Robust Policies for Dynamic Topologies and Diverse Attackers

Related

• When Autonomous Intelligent Goodware will Fight Autonomous Intelligent\n Malware: A Possible Future of Cyber Defense
• The Path To Autonomous Cyber Defense
• Use of Artificial Intelligence Techniques / Applications in Cyber Defense
• Toward Intelligent Autonomous Agents for Cyber Defense: Report of the 2017 Workshop by the North Atlantic Treaty Organization (NATO) Research Group IST-152-RTG
• Autonomous Intelligent Cyber-defense Agent (AICA) Reference Architecture. Release 2.0