Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agents

Harry Emerson, Liz Bates, Chris Hicks, Vasilios Mavroudis

TL;DR

MiniCAGE, a lightweight version of CAGE 2, which improves performance dramatically, up to 1000x faster execution in parallel iterations, without sacrificing accuracy or core functionality, is introduced.

Abstract

CybORG++ is an advanced toolkit for reinforcement learning research focused on network defence. Building on the CAGE 2 CybORG environment, it introduces key improvements, including enhanced debugging capabilities, refined agent implementation support, and a streamlined environment that enables faster training and easier customisation. Along with addressing several software bugs from its predecessor, CybORG++ introduces MiniCAGE, a lightweight version of CAGE 2, which improves performance dramatically, up to 1000x faster execution in parallel iterations, without sacrificing accuracy or core functionality. CybORG++ serves as a robust platform for developing and evaluating defensive agents, making it a valuable resource for advancing enterprise network defence research.

CybORG++: An Enhanced Gym for the Development of Autonomous Cyber Agents

TL;DR

MiniCAGE, a lightweight version of CAGE 2, which improves performance dramatically, up to 1000x faster execution in parallel iterations, without sacrificing accuracy or core functionality, is introduced.

Abstract

CybORG++ is an advanced toolkit for reinforcement learning research focused on network defence. Building on the CAGE 2 CybORG environment, it introduces key improvements, including enhanced debugging capabilities, refined agent implementation support, and a streamlined environment that enables faster training and easier customisation. Along with addressing several software bugs from its predecessor, CybORG++ introduces MiniCAGE, a lightweight version of CAGE 2, which improves performance dramatically, up to 1000x faster execution in parallel iterations, without sacrificing accuracy or core functionality. CybORG++ serves as a robust platform for developing and evaluating defensive agents, making it a valuable resource for advancing enterprise network defence research.

Paper Structure

This paper contains 11 sections, 2 figures.

Table of Contents

  1. Introduction
  2. CybORG - CAGE 2 Challenge
  3. Enhancements
  4. Extended Developer Guide
  5. MiniCAGE
  6. Optimisations
  7. Environment Benchmarking
  8. Potential Future Directions
  9. Codebase
  10. Acknowledgements
  11. Appendix

Figures (2)

  • Figure 1: CAGE 2 CybORG Network Diagram. The orange dotted line indicates a shared firewall between the User subnet and Enterprise subnet. The red dotted line indicates the defender is not a stationary host in the network, and that User0 is where red maintains a foothold on the system whilst not functioning as a proper user host.
  • Figure 2: Comparison of the developed MiniCAGE environment to the original CAGE 2 CybORG implementation. a) Execution speed improvement of MiniCAGE compared to CAGE 2 CybORG environment. MiniCAGE is highlighted to run is approximately 950$\times$ faster than CAGE 2 CybORG when running over 100 parallel iterations on a single CPU. Error bars show the standard error. b) Performance of six attacker-defender pairs in both environments to confirm the equivalence of the CybORG CAGE 2 and MiniCAGE environments. The strong correlation in agent behavior observed between both environments indicates consistent environmental dynamics.