Multi-Agent Reinforcement Learning-Based Automated Incident Response for Secure Digital Twin Environments

Multi-agent reinforcement learning for DoS mitigation in industrial control systems

The increasing frequency of cyber-attacks targeting industrial control systems (ICS) demonstrates the importance of digital resilience for Critical National Infrastructures. Denial of service (DoS) attacks have been shown to be highly effective against ICS environments due to the resource-constrained nature of industrial components and networks, such as programmable logic controllers (PLCs). Reinforcement learning (RL) can be used to address this challenge by dynamically managing and mitigating attack effects through statistical monitoring of underlying system behaviours, rather than using pre-trained data models commonly used in supervised and unsupervised machine learning approaches. In this paper, we propose a multi-agent reinforcement learning (MARL) framework that utilises software-defined networking (SDN) to achieve near real-time mitigation of DoS attacks targeting ICS networks. Specifically, we formulate network states using measurements extracted from industrial network communication protocols such as EtherNet/IP. Moreover, we exploit the scalability benefits of hierarchical learning to provide more granular agent decision making through a composite action space. We integrate an SDN controller with a virtualised OpenFlow switch to monitor network performance measurements such as average packet inter-arrival time to establish state behaviours. Through an emulated ICS network representing a live system, we mitigate the effects of different variants of DoS attacks with differing intensities, and highlight the performance improvements of using MARL compared to a single-agent framework. Our results show that MARL provides DoS recovery rates up to 83% faster than standard single-agent implementations, and improves network recovery rates compared with existing research.

Adversarial Vulnerabilities in Cooperative Multi-Agent Reinforcement Learning for Distributed 5G Security

This study provides among the first empirical evaluations of adversarial fragility in cooperative MARL-based intrusion detection within distributed 5G-oriented security abstractions, demonstrating that cooperative intelligence alone does not guarantee adversarial robustness.

Multi-Agent Reinforcement Learning System for Autonomous Network Intrusion Response

Cyber threats are becoming so complicated and rampant in today's highly connected digital world that there is a tremendous need for intelligent, adaptive IDS. Detecting and responding against network intrusions in real-time is the aim of the present work, which proposes a real-time Network Intrusion Detection and Automated Response Framework developed by Multi-Agent Deep Q-Network (MADQN). The proposed design uses the UNSW-NB15 network traffic set and discriminates and classifies attacks by using supervised machine learning models including Logistic Regression model, Decision Tree model, Random Forest model and the Neural Network classifiers. To augment the automation of the response, a reinforcement learning layer of three cooperative agents: Detection Agent, Blocking Agent and Isolation Agent is introduced based on Deep Q-Networks (DQNs). They learn the optimal mitigations actions they should take on a network state represented in 221 dimensions, and through the experience replay and epsilon-greedy exploration with the reinforcement learning, the agents learn. The results of the experiments demonstrate excellent response detection and 99.38% classification accuracy for the Random Forest model; for the intelligent response selection, the MADQN framework has a good neutralization rate of 93.94%. The architecture designed in the Flask can be fully integrated to the user authentication, attack prediction, attack response management and historical monitoring architecture. Overall, the proposed framework presents a powerful cybersecurity solution that integrates ML and MARL, enabling more secure and resilient networks.

Resilient Multi-Agent Deep Reinforcement Learning for Automatic Generation Control Under Adversarial Perturbations

Cyber Task Automation With Knowledge-Infused Reinforcement Learning and LLM-Guided Policies

As cyber threats continue to evolve, there is a need for Autonomous Cyber Defense (ACD) strategies capable of fast and context-aware responses. Reinforcement learning (RL) has shown promise in automating cyber defense by exploring and learning effective countermeasures. However, RL often struggles with sparse reward signals and insufficient context to handle diverse attack scenarios. Furthermore, the convergence time of an RL agent is often high, making it difficult to train the agent in online settings. To address these challenges, we propose a large language model (LLM)-enhanced RL method that builds and queries a knowledge base (KB) derived from agent–environment interactions. We leverage the pre-trained knowledge of an LLM on different cybersecurity frameworks and use the LLM to analyze parts of the KB to generate appropriate actions for the RL agent. The LLM-generated output is infused into the RL training process to improve performance and reduce convergence time. To validate our approach, we formulate two RL problems: a contextual bandit problem, which accounts for possible misclassifications of network flows by the detection module, and a multi-step RL problem, which considers that adversarial actions may be missed by monitoring or detection tools. For the contextual bandit problem, we develop a custom environment guided by the MITRE ATT&CK framework, while for the multi-step RL problem, we use a prominent Cybersecurity simulation platform named CybORG. Experimental results show that our proposed approach outperforms the baseline RL by over 75% and 65% in the contextual bandit and multi-step RL settings, respectively, in terms of selecting more effective actions.

Autonomous Cyber Defense Learning Using Reinforcement and Threat Intelligence

The increasing sophistication, frequency, and scale of cyberattacks have created significant challenges for conventional cybersecurity systems. Traditional security solutions such as firewalls, signature-based intrusion detection systems, and antivirus software are largely reactive and depend on predefined rules and known attack patterns. Consequently, these systems often struggle to detect and respond effectively to emerging threats such as Advanced Persistent Threats (APTs), zero-day attacks, ransomware, botnets, and insider attacks. Recent advancements in Artificial Intelligence (AI), particularly Reinforcement Learning (RL), have demonstrated the potential to create autonomous systems capable of learning and adapting to dynamic environments. Simultaneously, Cyber Threat Intelligence (CTI) provides valuable contextual information regarding threat actors, attack techniques, vulnerabilities, and indicators of compromise. This study proposes an Autonomous Cyber Defense Framework that integrates Reinforcement Learning and Threat Intelligence to enhance threat detection, decision-making, and automated response capabilities. The framework employs a Deep Q-Network (DQN) agent that continuously learns optimal defense actions through interaction with network environments while utilizing threat intelligence feeds to improve situational awareness. Experimental evaluation was conducted using benchmark cybersecurity datasets, including CICIDS2017 for Intrusion Detection, UNSW-NB15 for attack classification, CTU-13 for botnet detection and Custom Threat Feeds for threat intelligence. The results indicate that the proposed framework achieved a precision rate of 98.4%, a recall rate of 98.2%, an F1-score of 98.3%, and a threat mitigation rate of 96.8%. False positive rate of 1.9, False negative rate of 1.5 and Response rate of 41%, significantly outperforming traditional machine learning and signature-based security approaches. The findings demonstrate that integrating reinforcement learning with threat intelligence can provide a highly adaptive and proactive cyber defense mechanism suitable for modern network environments.