CAGE 2
A public benchmark environment for cyber defense, driven by the CybORG simulation framework, used to evaluate autonomous cyber defense agents by simulating red-versus-blue confrontation in a small enterprise network.
Timeline (last 90 days)
A recent paper proposes using a hidden Markov model (HMM) to uniformly characterize attacker behavior-mode switching and the time-varying feasibility of action parameters, and achieves performance superior to recurrent baselines on the CAGE 2 benchmark.
On the CAGE 2 benchmark, the filtered hidden states are worth 0.8 nats per step.
CAGE 2 is a public benchmark environment for cyber defense, whose full name is Cyber Attack Generator Environment 2, driven by the CybORG simulation framework and used to evaluate autonomous cyber defense agents.
CAGE 2 simulates a small enterprise network containing multiple hosts and subnets, in which the red agent (attacker) can perform actions such as scanning, exploitation, privilege escalation, and lateral movement, while the blue agent (defender) must detect and respond.
On this benchmark, the paper compares the HMM with recurrent neural network baselines, using per-step predictive log loss as the metric.
All Facts (5)
A recent paper proposes using a hidden Markov model (HMM) to uniformly characterize attacker behavior-mode switching and the time-varying feasibility of action parameters, and achieves performance superior to recurrent baselines on the CAGE 2 benchmark.
50%UnverifiedOn the CAGE 2 benchmark, the filtered hidden states are worth 0.8 nats per step.
50%UnverifiedCAGE 2 is a public benchmark environment for cyber defense, whose full name is Cyber Attack Generator Environment 2, driven by the CybORG simulation framework and used to evaluate autonomous cyber defense agents.
50%UnverifiedCAGE 2 simulates a small enterprise network containing multiple hosts and subnets, in which the red agent (attacker) can perform actions such as scanning, exploitation, privilege escalation, and lateral movement, while the blue agent (defender) must detect and respond.
50%UnverifiedOn this benchmark, the paper compares the HMM with recurrent neural network baselines, using per-step predictive log loss as the metric.
50%