Interpreting the behavior of reinforcement learning agents in the CAGE Challenge 2 network attack-defense simulation platform
Interpreting Agent Behaviors in Reinforcement-Learning-Based Cyber-Battle Simulation Platforms
AI summary
By simplifying the state and action spaces and tracking key events, the researchers interpreted the attack-defense performance of two open-source deep reinforcement learning agents in the CAGE Challenge 2 network defense challenge. The defender can usually clear an intrusion within one or two time steps after a host is exploited, but some important actions are 40% to 99% ineffective, and decoy services intercept at most 94% of exploits that can directly grant privileged access to hosts.