Large language models improve cyber defense across network sizes
Towards Hierarchical Cyber Defense with Large Language Models: From Planning to Execution
Cryptography and SecurityArtificial Intelligence
Summary
Defending computer networks from attacks is hard to scale because traditional defenders need retraining for each network size. The authors study how large language models (LLMs), which understand and generate language, can control cyber defense without retraining. They find that using LLMs both to plan and to act in defending networks works well across different sizes, keeping attacks very low. This means one model can protect many networks without needing to learn again each time.
What this means in practice
- •For enterprise security teams: Use the described LLM-based approach to protect networks of varying sizes without retraining defenders for each network change.
- •For cloud infrastructure operators: Deploy frozen large language models for automated cyber defense that adapts to scaling cloud network environments seamlessly.
Authors
Harshith Doppalapudi, Nathaniel D. Bastian, Ankit Shah
Abstract
An autonomous cyber defender trained with reinforcement learning (RL) is typically tied to the network on which it was trained, limiting its ability to generalize as network scale changes. Hierarchical RL reduces decision complexity by separating strategic targeting from tactical execution, but it does not eliminate this retraining dependence. We investigate whether frozen, zero-shot large language models (LLMs) can provide retraining-free control in hierarchical cyber defense and how performance changes as LLM control is extended from planning to execution. We formulate a controller-agnostic planner-executor hierarchy in which the planner selects a subnet to defend over a fixed horizon and the executor selects defensive actions within that subnet. Using the high fidelity Cyberwheel environment, with its built-in automated red team agent mapped to the MITRE ATT&CK framework, we compare RL+RL, LLM+RL, and LLM+LLM configurations using six models ranging from 3B to 70B parameters, including two cybersecurity-specialized models, across small, medium, and large networks. Replacing only the planner with an LLM yields limited gains as network size increases. In contrast, extending LLM control to execution produces notable improvements for sufficiently capable models. For instance, a frozen general purpose 70B model holds successful lateral movement to approximately 1% of steps and attacker impact near zero across all three network scales using the same model weights, while the RL baseline is retrained for each scale. Our results show that sufficiently capable frozen LLMs can maintain strong defensive performance across the evaluated network scales without task-specific retraining, while also indicating that strong tactical execution is important to realizing the benefits of LLM-based control.