AI summaryⓘ
The authors studied how large language models (LLMs) can help improve cybersecurity training by automatically creating fake network setups and finding hidden security problems. They used a format called YAML to describe these networks so that LLMs could assist in training reinforcement learning agents more effectively. Compared to older methods like Double Q-learning with Prioritized Experience Replay, their LLM-based approach was much faster and more realistic in simulating cyberattacks. Their tests showed that LLM-powered agents could compromise systems quickly, demonstrating a big boost in speed and adaptability. Overall, the authors suggest that combining LLMs with cybersecurity simulations could lead to smarter defenses.
Large Language ModelsCybersecurityReinforcement LearningYAMLDouble Q-learningPrioritized Experience ReplaySynthetic EnvironmentsCyberattack SimulationPython AgentsNetwork Configuration
Authors
Stylianos Kampakis, Fabio Rovai, Marcos Charalambides, Theodosis Mourouzis, Chris Hicks
Abstract
Cyber threats continue to escalate in both frequency and sophistication, necessitating more adaptive and scalable defense strategies. This paper explores how Large Language Models (LLMs) can bolster cybersecurity simulations by automating the creation of synthetic environments and identifying latent vulnerabilities. We employ YAML as a structured representation format for simulating complex network configurations, thereby enabling Large Language Model-driven pipelines to support and improve reinforcement learning (RL) agent training. Comparative studies examine the advantages of LLM-based techniques over classical approaches such as Double Q-learning with Prioritized Experience Replay (PER), emphasizing increased efficiency, higher adaptability, and enhanced realism in cyberattack simulations. In empirical benchmarks across multiple synthetic topologies, LLM-instantiated Python agents achieved up to a 94.5% compromise rate while executing in 0.02-0.06 seconds per assessment---a ~25,000x to 50,000x speedup over traditional RL training cycles. Our findings underscore the transformative potential of integrating LLMs into cybersecurity research, ultimately paving the way for more intelligent and robust cyber-defense systems.