BlueSTAR: A hierarchical agent architecture for autonomous cyber defense

Researchers propose BlueSTAR, a hierarchical agent architecture for autonomous cyber defense of enterprise IT/OT networks. The architecture first transforms high-volume security telemetry into compact indicators of compromise and introduces a resilience metric that simultaneously characterizes attacker reach, impact on mission-critical assets, and disruption caused by defensive actions. The team evaluated it on two operational enterprise IT/OT network testbeds using seven attack chains based on real intrusion techniques. Results show that BlueSTAR retains the ability to rapidly contain known threats with deterministic responses, while also defending against attacks that require context and cross-cycle reasoning, including credential theft, repeated intrusions, concurrent attackers, and attacks targeting physical processes.