An Empirical Game-Theoretic Analysis of Autonomous Cyber-Defence Agents

• DOI: 10.48550/arxiv.2501.19206
• Publication Date: 2025-01-01
• Authors: Palmer, Gregory; Swaby, Luke; Harrold, Daniel J...; Stewart, Matthew; Hiles, Alex; Willis, Chris; Miles, Ian; Farmer, Sara
• Keywords: FOS: Computer and information sciences; Computer Science - Cryptography and Security; Artificial Intelligence (cs.AI); Computer Science - Artificial Intelligence; Computer Science - Computer Science and Game Theory; Cryptography and Security (cs.CR); Computer Science and Game Theory (cs.GT)

The recent rise in increasingly sophisticated cyber-attacks raises the need for robust and resilient autonomous cyber-defence (ACD) agents. Given the variety of cyber-attack tactics, techniques and procedures (TTPs) employed, learning approaches that can return generalisable policies are desirable. Meanwhile, the assurance of ACD agents remains an open challenge. We address both challenges via an empirical game-theoretic analysis of deep reinforcement learning (DRL) approaches for ACD using the principled double oracle (DO) algorithm. This algorithm relies on adversaries iteratively learning (approximate) best responses against each others' policies; a computationally expensive endeavour for autonomous cyber operations agents. In this work we introduce and evaluate a theoretically-sound, potential-based reward shaping approach to expedite this process. In addition, given the increasing number of open-source ACD-DRL approaches, we extend the DO formulation to allow for multiple response oracles (MRO), providing a framework for a holistic evaluation of ACD approaches.<br/>21 pages, 17 figures, 10 tables<br/>