Learning Red Agent Policy from Observations for Neurosymbolic Autonomous Cyber Agents

Imitation learning technique infers red agent policy in partially observable cyber-defense environments

Researchers propose a Policy Learning Technique using imitation learning to infer attacker (red agent) policies from network observations and defender actions in partially observable autonomous cyber environments. The method integrates with neurosymbolic cyber-defense agents that use behavior trees with learning-enabled components. Evaluated across diverse simulated scenarios, the approach achieves high prediction accuracy for red agent actions, improving the defender's ability to anticipate intrusions.