Scholarlink

Cyber-threats continue to grow in both scale and sophistication, increasingly exceeding the capacity of human analysts and traditional static defenses. Autonomous Cyber Defense (ACD) aims to develop intelligent agents that can monitor, analyze, and counter attacks in real time. In this paper, we present a controlled evaluation of two distinct ACD paradigms within the CAGE-2 environment: (i) a Deep Reinforcement Learning (DRL) defender trained using Proximal Policy Optimization (PPO) combined with an Intrinsic Curiosity Module (ICM), and (ii) a Large Language Model (LLM) defender that applies state-of-the-art models with prompt-based decision making to select and explain defensive actions. The agents were tested against a range of red-team strategies and assessed with standardized performance metrics as well as qualitative measures of interpretability. Results indicate that the DRL-based agent achieved more consistent and reward-efficient performance, whereas the LLM-based agent demonstrated stronger transparency and adaptability to previously unseen attack tactics, albeit with greater computational cost and latency. Together, these findings point to complementary advantages of the two approaches and provide guidance for the design of future autonomous defense systems that combine high performance with explainability and robustness in dynamic operational settings.

错误：搜索内容不能为空，请输入英文关键词
错误：关键词超出字数限制，请精简
高级检索

Evaluating AI Agents for Cyber Defense: A Comparison of Deep Reinforcement Learning and LLM Approaches

  • 会议论文

  • 发表日期：

    2026年

查看全文
  • Hassan Chowdhry,
  • Jaume Manero,
  • Srinivas Sampalli

摘要

Cyber-threats continue to grow in both scale and sophistication, increasingly exceeding the capacity of human analysts and traditional static defenses. Autonomous Cyber Defense (ACD) aims to develop intelligent agents that can monitor, analyze, and counter attacks in real time. In this paper, we present a controlled evaluation of two distinct ACD paradigms within the CAGE-2 environment: (i) a Deep Reinforcement Learning (DRL) defender trained using Proximal Policy Optimization (PPO) combined with an Intrinsic Curiosity Module (ICM), and (ii) a Large Language Model (LLM) defender that applies state-of-the-art models with prompt-based decision making to select and explain defensive actions. The agents were tested against a range of red-team strategies and assessed with standardized performance metrics as well as qualitative measures of interpretability. Results indicate that the DRL-based agent achieved more consistent and reward-efficient performance, whereas the LLM-based agent demonstrated stronger transparency and adaptability to previously unseen attack tactics, albeit with greater computational cost and latency. Together, these findings point to complementary advantages of the two approaches and provide guidance for the design of future autonomous defense systems that combine high performance with explainability and robustness in dynamic operational settings.