Sélection de la langue

Gouvernement du Canada / Government of Canada

Recherche

Cyber threat mitigation with knowledge-infused reinforcement learning and LLM-guided policies

DOITrouver le DOI : https://doi.org/10.1109/PST65910.2025.11268866
AuteurRechercher : 1; Rechercher : 1Identifiant ORCID : https://orcid.org/0000-0001-7819-5715; Rechercher : 1Identifiant ORCID : https://orcid.org/0000-0002-1241-6391; Rechercher : 2; Rechercher : 1; Rechercher : 3; Rechercher : 3
Affiliation
  1. Conseil national de recherches Canada. Technologies numériques
  2. University of Regina
  3. Recherche et développement pour la défense Canada
FormatTexte, Article
Conférence2025 22nd Annual International Conference on Privacy, Security, and Trust (PST), August 26-28, 2025, Fredericton, New Brunswick, Canada
Sujetreinforcement learning; large language models; knowledge graphs; cybersecurity automation; autonomous cyber defense
Résumé
As cyber threats continue to evolve, there is a need for autonomous cyber defense (ACD) strategies capable of fast and context-aware responses. Reinforcement learning (RL) has shown promise for automating cyber defense by exploring and learning effective countermeasures, yet it often struggles with sparse reward signals and insufficient context to handle diverse attack scenarios. Furthermore, the convergence time taken by an RL agent is often high, which makes it difficult to train the RL agent in online settings. To address these challenges, we propose a large language model (LLM)-enhanced RL method that builds and queries a knowledge graph (KG) derived from agent-environment interactions. We leverage the pre-trained knowledge of an LLM on different cybersecurity frameworks and use the LLM to analyze a part of the KG to generate appropriate actions for the RL agent. We infuse the knowledge extracted from the LLM into the RL agent’s training loop in two ways. First, the state vector of the RL agent is augmented with the most effective action and its corresponding reward, as determined from the KG. Second, the suggested action from the LLM is used as a reference policy. In addition, we introduce a regularization term in the loss function to make the RL policy close to the reference policy. To validate our approach, we develop a custom RL environment guided by the MITRE ATT&CK framework, enabling the agent to generate tailored mitigation strategies for detected cyber attacks. Experimental results show that our proposed approach significantly outperforms the baseline RL by over 75% in terms of taking better mitigation actions.
Date de publication
Maison d’éditionInstitute of Electrical and Electronics Engineers
Dans
  • 2025 22nd Annual International Conference on Privacy, Security, and Trust (PST), 11268866 (3 décembre 2025) : 1–10.
Langueanglais
Publications évaluées par des pairsOui
Exporter la noticeExporter en format RIS
Signaler une correctionSignaler une correction (s'ouvre dans un nouvel onglet)
Identificateur de l’enregistrement54ad03ef-8f8d-4509-9e6b-ae2b369343bd
Enregistrement créé2026-04-16
Enregistrement modifié2026-05-27

Détails de la page

Par :

Date de modification :