Applying Multi-Agent Reinforcement Learning (MARL) in a Cyber Wargame Engine

Jan 11, 2023

MP4 Video

Watch on YouTube

Abstract

Cybersecurity is inherently complicated due to the dynamic nature of the threats andever-expanding attack surfaces.  Ironically,this challenge is exacerbated by the rapid advancement of many new technologieslike Internet of Things (IoT) devices, 5G infrastructure, cloud-basedcomputing, etc.  This is where artificialintelligence (AI) and machine learning (ML) techniques can be called intoservice, and provide potential solutions in terms of threat detection andmitigation responses in a rapidly changing environment.  On contrary, humans are often limited by theirinnate inability to process information and fail to recognize/respond to attackpatterns in the multi-dimensional, multi-faceted world.  The recent DARPA AlphaDogFight has proven AIpilots can defeat even the best human pilot in air-to-air combat.  This prompted our engineers to develop aminimum viable product (MVP) that demonstrates the value of a multi-agent reinforcementlearning (MARL) architecture in a simulated cyber wargaming environment.   By using our simulation framework, we essentially"trained" the learning agents to produce the optimum combination/permutation ofcyber attack vectors in a given scenario. This cyber wargaming engine allows our analysts to examine tactics,techniques and procedures (TTPs) potentially employed by our adversaries.  Once these vulnerabilities are analyzed, ourcyber protection team (CPT) can close security gaps in the system.