{"id":"https://openalex.org/W7133293543","doi":"https://doi.org/10.48550/arxiv.2603.01340","title":"SubstratumGraphEnv: Reinforcement Learning Environment (RLE) for Modeling System Attack Paths","display_name":"SubstratumGraphEnv: Reinforcement Learning Environment (RLE) for Modeling System Attack Paths","publication_year":2026,"publication_date":"2026-03-02","ids":{"openalex":"https://openalex.org/W7133293543","doi":"https://doi.org/10.48550/arxiv.2603.01340"},"language":"en","primary_location":{"id":"pmh:doi:10.13016/m2qybr-6fhc","is_oa":false,"landing_page_url":"http://hdl.handle.net/11603/42272","pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.01340","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5081995639","display_name":"Bahirah Adewunmi","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Adewunmi, Bahirah","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068036546","display_name":"Edward Raff","orcid":"https://orcid.org/0000-0002-9900-1972"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Raff, Edward","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"Purushotham, Sanjay","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Purushotham, Sanjay","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4359000027179718,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.4359000027179718,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.257999986410141,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.07760000228881836,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.8086000084877014},{"id":"https://openalex.org/keywords/graph","display_name":"Graph","score":0.46810001134872437},{"id":"https://openalex.org/keywords/identification","display_name":"Identification (biology)","score":0.41260001063346863},{"id":"https://openalex.org/keywords/variety","display_name":"Variety (cybernetics)","score":0.3955000042915344},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.38679999113082886},{"id":"https://openalex.org/keywords/event","display_name":"Event (particle physics)","score":0.36649999022483826},{"id":"https://openalex.org/keywords/graphical-user-interface","display_name":"Graphical user interface","score":0.35989999771118164}],"concepts":[{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.8086000084877014},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6930999755859375},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5770999789237976},{"id":"https://openalex.org/C132525143","wikidata":"https://www.wikidata.org/wiki/Q141488","display_name":"Graph","level":2,"score":0.46810001134872437},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.41260001063346863},{"id":"https://openalex.org/C136197465","wikidata":"https://www.wikidata.org/wiki/Q1729295","display_name":"Variety (cybernetics)","level":2,"score":0.3955000042915344},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.38679999113082886},{"id":"https://openalex.org/C2779662365","wikidata":"https://www.wikidata.org/wiki/Q5416694","display_name":"Event (particle physics)","level":2,"score":0.36649999022483826},{"id":"https://openalex.org/C37789001","wikidata":"https://www.wikidata.org/wiki/Q782543","display_name":"Graphical user interface","level":2,"score":0.35989999771118164},{"id":"https://openalex.org/C48103436","wikidata":"https://www.wikidata.org/wiki/Q599031","display_name":"State (computer science)","level":2,"score":0.3440000116825104},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.33550000190734863},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.33469998836517334},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.3278999924659729},{"id":"https://openalex.org/C110963975","wikidata":"https://www.wikidata.org/wiki/Q12070446","display_name":"Systems modeling","level":2,"score":0.3050999939441681},{"id":"https://openalex.org/C119247159","wikidata":"https://www.wikidata.org/wiki/Q1366192","display_name":"System identification","level":3,"score":0.2948000133037567},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.2892000079154968},{"id":"https://openalex.org/C107645828","wikidata":"https://www.wikidata.org/wiki/Q12070446","display_name":"System model","level":2,"score":0.26899999380111694},{"id":"https://openalex.org/C155846161","wikidata":"https://www.wikidata.org/wiki/Q1143367","display_name":"Graphical model","level":2,"score":0.2671000063419342}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:doi:10.13016/m2qybr-6fhc","is_oa":false,"landing_page_url":"http://hdl.handle.net/11603/42272","pdf_url":null,"source":{"id":"https://openalex.org/S4406922384","display_name":"Open MIND","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},{"id":"doi:10.48550/arxiv.2603.01340","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.01340","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.01340","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.01340","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Automating":[0],"network":[1],"security":[2],"analysis,":[3],"particularly":[4],"the":[5,18,49,92,123,157,165,183],"identification":[6],"of":[7,24,51,62,171,185,195],"potential":[8],"attack":[9],"paths,":[10],"presents":[11],"significant":[12],"challenges.":[13],"Due":[14],"in":[15,94,182],"part":[16],"to":[17,34,106,121,139,234],"sequential,":[19],"interconnected,":[20],"and":[21,74,99,108,130,149,160,168,198,219],"evolutionary":[22],"nature":[23],"system":[25,72,95,199,229],"events":[26,230],"which":[27,163,228],"most":[28],"artificial":[29],"intelligence":[30],"(AI)":[31],"techniques":[32],"struggle":[33],"model":[35,109],"effectively.":[36],"This":[37,68,80,177,207],"paper":[38],"proposes":[39],"a":[40,55,66,77,102,131,186,210],"Reinforcement":[41,145],"Learning":[42,146],"(RL)":[43],"environment":[44,117,191],"generation":[45],"framework":[46],"that":[47,192],"simulates":[48],"sequence":[50],"processes":[52,64,111],"executed":[53],"on":[54,65],"Windows":[56],"operating":[57,71],"system,":[58],"enabling":[59],"dynamic":[60],"modeling":[61],"malicious":[63],"system.":[67],"methodology":[69],"models":[70],"state":[73],"transitions":[75],"using":[76],"graph":[78,81],"representation.":[79],"is":[82],"derived":[83],"from":[84,112],"open-source":[85],"System":[86],"Monitor":[87],"(Sysmon)":[88],"logs.":[89,114],"To":[90],"address":[91],"variety":[93],"event":[96],"types,":[97],"fields,":[98],"log":[100],"formats,":[101],"mechanism":[103],"was":[104,119,135],"developed":[105],"capture":[107],"parent-child":[110],"Sysmon":[113],"A":[115],"Gymnasium":[116,141],"(SubstratumGraphEnv)":[118],"constructed":[120],"establish":[122],"perceptible":[124],"basis":[125],"for":[126,204,212],"an":[127,172],"RL":[128,190,237],"environment,":[129],"customized":[132],"PyTorch":[133],"interface":[134],"also":[136,224],"built":[137],"(SubstratumBridge)":[138],"translate":[140],"graphs":[142],"into":[143,215,227],"Deep":[144],"(DRL)":[147],"observations":[148],"discrete":[150],"actions.":[151],"Graph":[152],"Convolutional":[153],"Networks":[154],"(GCNs)":[155],"concretize":[156],"graph's":[158],"local":[159],"global":[161],"state,":[162],"feed":[164],"distinct":[166],"policy":[167],"critic":[169],"heads":[170],"Advantage":[173],"Actor-Critic":[174],"(A2C)":[175],"model.":[176],"work's":[178],"central":[179],"contribution":[180],"lies":[181],"design":[184],"novel":[187],"deep":[188],"graphical":[189],"automates":[193],"translation":[194],"sequential":[196],"user":[197],"events,":[200],"furnishing":[201],"crucial":[202],"context":[203],"cybersecurity":[205],"analysis.":[206],"work":[208],"provides":[209],"foundation":[211],"future":[213],"research":[214],"shaping":[216],"training":[217,235],"parameters":[218],"advanced":[220],"reward":[221],"shaping,":[222],"while":[223],"offering":[225],"insight":[226],"attributes":[231],"are":[232],"critical":[233],"autonomous":[236],"agents.":[238]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-03-04T00:00:00"}