Cyberworld enables efficient autonomous cyber defense with predictive models
CyberWorld: World Models for Sample-Efficient Autonomous Cyber Defense
Machine LearningArtificial IntelligenceCryptography and Security
Summary
Keeping computer networks safe from attacks often requires software to learn how to defend them by trying lots of actions. The authors developed CyberWorld, a method that can learn to protect networks much faster by imagining what might happen next instead of trying every possibility. This method uses different ways to represent the network, like graphs that show connections, which help it defend better when the network layout changes. CyberWorld works well even as networks get bigger, using fewer training steps than older methods.
What this means in practice
- •For cybersecurity teams: Automate cyber defenses that learn quicker from less data to protect enterprise networks against complex attacks.
- •For robotics engineers: Adapt world modeling techniques used here to improve sample efficiency in robotic control systems with graph-based representations.
Authors
Ryozo Masukawa, Sanggeon Yun, Raheeb Hassan, Hyunwoo Oh, SungHeon Jeong, Mohsen Imani
Abstract
Deep reinforcement learning has become a prominent approach to autonomous cyber defense. Existing methods are predominantly model-free and consequently require extensive environment interaction. World models provide an alternative by learning predictive dynamics and optimizing policies through imagined trajectories, yielding substantial gains in sample efficiency in robotics and embodied control. Extending this paradigm to cybersecurity raises a fundamental question: what should constitute the "world" in a cyber world model? We introduce CyberWorld, a Dreamer-style world modeling framework that learns latent cyber dynamics from vector, graph, textual, and multimodal representations of the defended network. Across all four scoreable CyberWheel attack strategies, the graph-based CyberWorld variant exceeds a strategy-agnostic control after 3.6k-15.8k environment steps, compared with millions of steps required by model-free PPO. Across representation choices, graph structure provides greater robustness under topology-dependent attacks, while simpler representations remain competitive in overall performance. Among successful runs, the number of episodes required to reach the control remains approximately constant as network size increases from 15 to 100 hosts. These results establish learned cyber dynamics as a sample-efficient and scalable basis for autonomous defense, and identify world representation as a central design axis for robustness and scalability.