{"id":"https://openalex.org/W7160489318","doi":"https://doi.org/10.1016/j.eswa.2026.132741","title":"Explainable autonomous cyber defense using adversarial multi-agent reinforcement learning","display_name":"Explainable autonomous cyber defense using adversarial multi-agent reinforcement learning","publication_year":2026,"publication_date":"2026-05-07","ids":{"openalex":"https://openalex.org/W7160489318","doi":"https://doi.org/10.1016/j.eswa.2026.132741"},"language":"en","primary_location":{"id":"doi:10.1016/j.eswa.2026.132741","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.eswa.2026.132741","pdf_url":null,"source":{"id":"https://openalex.org/S13144211","display_name":"Expert Systems with Applications","issn_l":"0957-4174","issn":["0957-4174","1873-6793"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Expert Systems with Applications","raw_type":"journal-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"hybrid","oa_url":"https://doi.org/10.1016/j.eswa.2026.132741","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133124743","display_name":"Yiyao Zhang","orcid":null},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yiyao Zhang","raw_affiliation_strings":["School of Computer Science and Information Technology, Adelaide University, Australia"],"raw_orcid":"https://orcid.org/0009-0009-6018-2612","affiliations":[{"raw_affiliation_string":"School of Computer Science and Information Technology, Adelaide University, Australia","institution_ids":["https://openalex.org/I5681781"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084412291","display_name":"Diksha Goel","orcid":"https://orcid.org/0000-0001-8212-8793"},"institutions":[{"id":"https://openalex.org/I1292875679","display_name":"Commonwealth Scientific and Industrial Research Organisation","ror":"https://ror.org/03qn8fb07","country_code":"AU","type":"government","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I4387156119"]},{"id":"https://openalex.org/I42894916","display_name":"Data61","ror":"https://ror.org/03q397159","country_code":"AU","type":"other","lineage":["https://openalex.org/I1292875679","https://openalex.org/I2801453606","https://openalex.org/I42894916","https://openalex.org/I4387156119"]}],"countries":["AU"],"is_corresponding":true,"raw_author_name":"Diksha Goel","raw_affiliation_strings":["CSIRO\u2019s Data61, Australia"],"raw_orcid":"https://orcid.org/0000-0001-8212-8793","affiliations":[{"raw_affiliation_string":"CSIRO\u2019s Data61, Australia","institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5135537594","display_name":"Hussain Ahmad","orcid":"https://orcid.org/0009-0001-9940-2733"},"institutions":[{"id":"https://openalex.org/I5681781","display_name":"The University of Adelaide","ror":"https://ror.org/00892tw58","country_code":"AU","type":"education","lineage":["https://openalex.org/I5681781"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Hussain Ahmad","raw_affiliation_strings":["School of Computer Science and Information Technology, Adelaide University, Australia"],"raw_orcid":"https://orcid.org/0009-0001-9940-2733","affiliations":[{"raw_affiliation_string":"School of Computer Science and Information Technology, Adelaide University, Australia","institution_ids":["https://openalex.org/I5681781"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":["https://openalex.org/A5084412291"],"corresponding_institution_ids":["https://openalex.org/I1292875679","https://openalex.org/I42894916"],"apc_list":{"value":3220,"currency":"USD","value_usd":3220},"apc_paid":{"value":3220,"currency":"USD","value_usd":3220},"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.56404419,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"326","issue":null,"first_page":"132741","last_page":"132741"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6743000149726868,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.6743000149726868,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.12160000205039978,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.052000001072883606,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.7383000254631042},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.7114999890327454},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.7021999955177307},{"id":"https://openalex.org/keywords/ambiguity","display_name":"Ambiguity","score":0.5716999769210815},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5546000003814697},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.4916999936103821},{"id":"https://openalex.org/keywords/situation-awareness","display_name":"Situation awareness","score":0.40119999647140503},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.36070001125335693},{"id":"https://openalex.org/keywords/autonomous-agent","display_name":"Autonomous agent","score":0.3528999984264374},{"id":"https://openalex.org/keywords/robot","display_name":"Robot","score":0.35199999809265137}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7493000030517578},{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.7383000254631042},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7114999890327454},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.7021999955177307},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.5716999769210815},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5546000003814697},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5062999725341797},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.4916999936103821},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.4359000027179718},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4237000048160553},{"id":"https://openalex.org/C145804949","wikidata":"https://www.wikidata.org/wiki/Q478123","display_name":"Situation awareness","level":2,"score":0.40119999647140503},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.36070001125335693},{"id":"https://openalex.org/C13687954","wikidata":"https://www.wikidata.org/wiki/Q4826847","display_name":"Autonomous agent","level":2,"score":0.3528999984264374},{"id":"https://openalex.org/C90509273","wikidata":"https://www.wikidata.org/wiki/Q11012","display_name":"Robot","level":2,"score":0.35199999809265137},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3499999940395355},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.33250001072883606},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.329800009727478},{"id":"https://openalex.org/C17098449","wikidata":"https://www.wikidata.org/wiki/Q176814","display_name":"Partially observable Markov decision process","level":4,"score":0.3264999985694885},{"id":"https://openalex.org/C84525736","wikidata":"https://www.wikidata.org/wiki/Q831366","display_name":"Decision tree","level":2,"score":0.3255999982357025},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.30970001220703125},{"id":"https://openalex.org/C107327155","wikidata":"https://www.wikidata.org/wiki/Q330268","display_name":"Decision support system","level":2,"score":0.303600013256073},{"id":"https://openalex.org/C72434380","wikidata":"https://www.wikidata.org/wiki/Q230930","display_name":"State space","level":2,"score":0.2915000021457672},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.28679999709129333},{"id":"https://openalex.org/C34413123","wikidata":"https://www.wikidata.org/wiki/Q170978","display_name":"Robotics","level":3,"score":0.2833999991416931},{"id":"https://openalex.org/C43521106","wikidata":"https://www.wikidata.org/wiki/Q2165493","display_name":"Pipeline (software)","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C64357122","wikidata":"https://www.wikidata.org/wiki/Q1149766","display_name":"Causality (physics)","level":2,"score":0.2768999934196472},{"id":"https://openalex.org/C123657996","wikidata":"https://www.wikidata.org/wiki/Q12271","display_name":"Architecture","level":2,"score":0.2703999876976013},{"id":"https://openalex.org/C146380142","wikidata":"https://www.wikidata.org/wiki/Q1137726","display_name":"Directed graph","level":2,"score":0.26899999380111694},{"id":"https://openalex.org/C74197172","wikidata":"https://www.wikidata.org/wiki/Q1195339","display_name":"Directed acyclic graph","level":2,"score":0.2685999870300293},{"id":"https://openalex.org/C176856949","wikidata":"https://www.wikidata.org/wiki/Q2001676","display_name":"Offensive","level":2,"score":0.2680000066757202},{"id":"https://openalex.org/C2780179797","wikidata":"https://www.wikidata.org/wiki/Q345844","display_name":"Crew","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C56397880","wikidata":"https://www.wikidata.org/wiki/Q6044094","display_name":"Intelligent decision support system","level":2,"score":0.2538999915122986},{"id":"https://openalex.org/C2984634286","wikidata":"https://www.wikidata.org/wiki/Q1331926","display_name":"Decision process","level":2,"score":0.25270000100135803},{"id":"https://openalex.org/C98763669","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov chain","level":2,"score":0.25119999051094055}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1016/j.eswa.2026.132741","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.eswa.2026.132741","pdf_url":null,"source":{"id":"https://openalex.org/S13144211","display_name":"Expert Systems with Applications","issn_l":"0957-4174","issn":["0957-4174","1873-6793"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Expert Systems with Applications","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1016/j.eswa.2026.132741","is_oa":true,"landing_page_url":"https://doi.org/10.1016/j.eswa.2026.132741","pdf_url":null,"source":{"id":"https://openalex.org/S13144211","display_name":"Expert Systems with Applications","issn_l":"0957-4174","issn":["0957-4174","1873-6793"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320990","host_organization_name":"Elsevier BV","host_organization_lineage":["https://openalex.org/P4310320990"],"host_organization_lineage_names":["Elsevier BV"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Expert Systems with Applications","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":22,"referenced_works":["https://openalex.org/W1523756834","https://openalex.org/W2891503716","https://openalex.org/W2910711617","https://openalex.org/W2963095307","https://openalex.org/W2981038142","https://openalex.org/W3005847836","https://openalex.org/W3157719223","https://openalex.org/W3185895012","https://openalex.org/W4292289324","https://openalex.org/W4293106276","https://openalex.org/W4293211096","https://openalex.org/W4379380408","https://openalex.org/W4379878829","https://openalex.org/W4382281941","https://openalex.org/W4386648688","https://openalex.org/W4390737701","https://openalex.org/W4394717207","https://openalex.org/W4400420714","https://openalex.org/W4400461591","https://openalex.org/W4404534210","https://openalex.org/W4411242563","https://openalex.org/W4415220299"],"related_works":[],"abstract_inverted_index":{"Autonomous":[0],"agents":[1],"are":[2,71],"increasingly":[3],"deployed":[4],"in":[5,16,38,164,225],"both":[6],"offensive":[7],"and":[8,31,55,70,116,187,222,239,252],"defensive":[9],"cyber":[10,95],"operations,":[11],"creating":[12],"high-speed,":[13],"closed-loop":[14],"interactions":[15],"critical":[17],"infrastructure":[18],"environments.":[19],"Advanced":[20],"Persistent":[21],"Threat":[22],"(APT)":[23],"actors":[24],"exploit":[25],"\u201dLiving":[26],"off":[27],"the":[28,83,208,214],"Land\u201d":[29],"techniques":[30],"targeted":[32],"telemetry":[33,115],"perturbations":[34],"to":[35,44,73,147,230],"induce":[36],"ambiguity":[37],"monitoring":[39],"systems,":[40],"causing":[41],"automated":[42],"defenses":[43],"overreact":[45],"or":[46,78],"misclassify":[47],"benign":[48],"behavior":[49],"as":[50,135,201],"malicious":[51],"activity.":[52],"Existing":[53],"monolithic":[54],"multi-agent":[56],"defense":[57,96],"pipelines":[58],"largely":[59],"operate":[60],"on":[61,67],"correlation-based":[62],"signals,":[63],"lack":[64],"structural":[65],"constraints":[66],"response":[68,129],"actions,":[69],"vulnerable":[72],"reasoning":[74],"drift":[75],"under":[76,205,261],"ambiguous":[77],"adversarial":[79,102],"inputs.":[80],"We":[81],"present":[82],"Causal":[84,110],"Multi-Agent":[85],"Decision":[86,138],"Framework":[87],"(C-MADF),":[88],"a":[89,108,136,159,166,173,183,190],"structurally":[90],"constrained":[91,154],"architecture":[92],"for":[93],"autonomous":[94,259],"that":[97,126,199],"integrates":[98],"causal":[99],"modeling":[100],"with":[101,194,249],"dual-policy":[103],"control.":[104],"C-MADF":[105,212],"first":[106],"learns":[107],"Structural":[109],"Model":[111],"(SCM)":[112],"from":[113,217],"historical":[114],"compiles":[117],"it":[118],"into":[119],"an":[120,195,202],"investigation-level":[121],"Directed":[122],"Acyclic":[123],"Graph":[124],"(DAG)":[125],"defines":[127],"admissible":[128],"transitions.":[130,150],"This":[131],"roadmap":[132],"is":[133,144,156,170,180],"formalized":[134],"Markov":[137],"Process":[139],"(MDP)":[140],"whose":[141],"action":[142],"space":[143,155],"explicitly":[145],"restricted":[146],"causally":[148],"consistent":[149],"Decision-making":[151],"within":[152],"this":[153],"performed":[157],"by":[158,172],"dual-agent":[160],"reinforcement":[161],"learning":[162],"system":[163],"which":[165],"threat-optimizing":[167],"Blue-Team":[168],"policy":[169,253],"counterbalanced":[171],"conservatively":[174],"shaped":[175],"Red-Team":[176],"policy.":[177],"Inter-policy":[178],"disagreement":[179],"quantified":[181],"through":[182],"Policy":[184],"Divergence":[185],"Score":[186,197],"exposed":[188],"via":[189],"human-in-the-loop":[191],"interface":[192],"equipped":[193],"Explainability\u2013Transparency":[196],"(ETS)":[198],"serves":[200],"escalation":[203,257],"signal":[204,244],"uncertainty.":[206,262],"On":[207],"real-world":[209],"CICIoT2023":[210],"dataset,":[211],"reduces":[213],"false-positive":[215],"rate":[216],"11.2":[218],"percent,":[219,221,232],"9.7":[220],"8.4":[223],"percent":[224],"three":[226],"cutting-edge":[227],"literature":[228],"baselines":[229],"1.8":[231],"while":[233],"achieving":[234],"0.997":[235],"precision,":[236],"0.961":[237],"recall,":[238],"0.979":[240],"F1-score.":[241],"The":[242],"ETS":[243],"exhibits":[245],"strong":[246],"monotonic":[247],"alignment":[248],"evidentiary":[250],"sufficiency":[251],"agreement,":[254],"supporting":[255],"calibrated":[256],"of":[258],"actions":[260]},"counts_by_year":[],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2026-05-08T00:00:00"}