Autonomous Cyber Defense

Follow this topic Ask about this topic

Autonomous cyber defense studies how systems can monitor networks and devices, recognize attacks, and choose responses such as blocking access, patching, deception, or recovery. Common approaches include reinforcement learning and partially observable decision models, graph-based attack analysis, coordinated agents, and language-model planners connected to security tools. Researchers test these methods in simulated networks, cyber ranges, and emulated enterprise, industrial, and IoT settings, measuring not only detection but also containment, response time, and service disruption. A central challenge is making policies reliable against adaptive attackers and unfamiliar environments while ensuring actions stay within safety and operational limits.

Latest papers

72 papers10 papers in the last four weeks, up 43% on the four weeks before. 0.1% of all new papers.

Design Principles for the Construction of a Benchmark Evaluating Security Operation Capabilities of Multi-agent AI Systems
Mar 30, 2026Yicheng Cai, Mitchell John DeStefano, Guodong Dong +5AI Agent Security Benchmarks Cybersecurity
Cyber Security Laboratory Pennsylvania State University, University Park
Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage
Mar 25, 2026Rishikesh Sahay, Bell Eapen, Weizhi Meng +5Autonomous Cyber Defense
Department of Management Information Systems, University of Illinois, Springfield, USA · School of Computing and Communications, Lancaster University, United Kingdom · School of Computer Applications, Kalinga Institute of Industrial Technology, India +1
DeepXplain: XAI-Guided Autonomous Defense Against Multi-Stage APT Campaigns
Mar 22, 2026Trung V. Phan, Thomas BauschertAutonomous Cyber Defense Reinforcement Learning
Chair of Communication Networks, Technische Universität Chemnitz, 09126 Chemnitz, Germany
Cyber Deception for Mission Surveillance via Hypergame-Theoretic Deep Reinforcement Learning
Mar 21, 2026Zelin Wan, Jin-Hee Cho, Mu Zhu +3Cybersecurity Autonomous Cyber Defense
Department of Computer Science, Virginia Tech, Falls Church, VA, USA · Computer Network Information Center, Chinese Academy of Sciences, Beijing, China · US Army Research Laboratory, Adelphi, MD, USA +1
Learning Communication Between Heterogeneous Agents in Multi-Agent Reinforcement Learning for Autonomous Cyber Defence
Mar 17, 2026Alex Popa, Adrian Taylor, Ranwa Al MallahAutonomous Cyber Defense Heterogeneous MARL
Department of Electrical and Computer Engineering, Royal Military College of Canada, Kingston Ontario, Canada · Defence Research and Development Canada, Ottawa Ontario, Canada · Department of Computer Engineering and Software Engineering, Polytechnique Montr´eal, Montr´eal Qu´ebec, Canada
DeepStage: Learning Autonomous Defense Policies Against Multi-Stage APT Campaigns
Mar 17, 2026Trung V. Phan, Tri Gia Nguyen, Thomas BauschertAutonomous Cyber Defense
Chair of Communication Networks, Technische Universität Chemnitz, 09126 Chemnitz, Germany · Department of Information Assurance, FPT University, Da Nang 50509, Vietnam
Towards Agentic Honeynet Configuration
Mar 14, 2026Federico Mirra, Matteo Boffa, Idilio Drago +2Autonomous Cyber Defense Agentic AI
Politecnico di Torino · Universit`a di Torino
From Passive Monitoring to Active Defence: Resilient Control of Manipulators Under Cyberattacks
Mar 13, 2026Gabriele Gualandi, Alessandro V. PapadopoulosCyber-Physical Systems False Data Injection Attacks
Department of Computer Science and Engineering, Mälardalen University, Västerås, Sweden
From Threat Intelligence to Firewall Rules: Semantic Relations in Hybrid AI Agent and Expert System Architectures
Mar 4, 2026Chiara Bonfanti, Davide Colaiacomo, Luca Cagliero +1Autonomous Cyber Defense Cyber Threat Intelligence
Department of Control and Computer Engineering, Politecnico di Torino, Italy
SubstratumGraphEnv: Reinforcement Learning Environment (RLE) for Modeling System Attack Paths
Mar 2, 2026Bahirah Adewunmi, Edward Raff, Sanjay PurushothamReinforcement Learning Autonomous Cyber Defense
University of Maryland, Baltimore County · CrowdStrike
LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance
Feb 27, 2026Chuanming Tang, Ling Qing, Shifeng ChenAutonomous Cyber Defense Multi-Agent Systems
Shenzhen Institute of Advanced Technology, CAS · Sangfor Technologies Inc. · College of Management Science +2
RLShield: Practical Multi-Agent RL for Financial Cyber Defense with Attack-Surface MDPs and Real-Time Response Orchestration
Feb 26, 2026Srikumar NayakAutonomous Cyber Defense Cybersecurity
Incedo Inc, USA

Mar 30, 2026J/K move · Enter open · S save

Design Principles for the Construction of a Benchmark Evaluating Security Operation Capabilities of Multi-agent AI Systems

Yicheng Cai, Mitchell John DeStefano, Guodong Dong, Pulkit Handa+4

Cyber Security Laboratory Pennsylvania State University, University Park

AI Agent Security Benchmarks Cybersecurity Autonomous Cyber Defense Multi-Agent System Security

Open paper AskPDF arXiv

As Large Language Models (LLMs) and multi-agent AI systems are demonstrating increasing potential in cybersecurity operations, organizations, policymakers, model providers, and researchers in the AI and cybersecurity communities are interested in quantifying the capabilities of such AI systems to achieve more autonomous SOCs (security operation centers) and reduce manual effort. In particular, the AI and cybersecurity communities have recently developed several benchmarks for evaluating the red team capabilities of multi-agent AI systems. However, because the operations in SOCs are dominated by blue team operations, the capabilities of AI systems & agents to achieve more autonomous SOCs cannot be evaluated without a benchmark focused on blue team operations. To our best knowledge, no systematic benchmark for evaluating coordinated multi-task blue team AI has been proposed in the literature. Existing blue team benchmarks focus on a particular task. The goal of this work is to develop a set of design principles for the construction of a benchmark, which is denoted as SOC-bench, to evaluate the blue team capabilities of AI. Following these design principles, we have developed a conceptual design of SOC-bench, which consists of a family of five blue team tasks in the context of large-scale ransomware attack incident response.