{"id":"https://openalex.org/W7164994887","doi":"https://doi.org/10.48550/arxiv.2606.18223","title":"Learning Red Agent Policy from Observations for Neurosymbolic Autonomous Cyber Agents","display_name":"Learning Red Agent Policy from Observations for Neurosymbolic Autonomous Cyber Agents","publication_year":2026,"publication_date":"2026-06-16","ids":{"openalex":"https://openalex.org/W7164994887","doi":"https://doi.org/10.48550/arxiv.2606.18223"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.18223","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18223","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.18223","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5133489461","display_name":"Ankita Samaddar","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Samaddar, Ankita","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5133438496","display_name":"Sandeep Neema","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Neema, Sandeep","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138786125","display_name":"Daniel Balasubramanian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Balasubramanian, Daniel","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138826396","display_name":"Xenofon Koutsoukos","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Koutsoukos, Xenofon","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3188999891281128,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.3188999891281128,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10734","display_name":"Information and Cyber Security","score":0.13689999282360077,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10714","display_name":"Software-Defined Networks and 5G","score":0.10570000112056732,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/reinforcement-learning","display_name":"Reinforcement learning","score":0.715499997138977},{"id":"https://openalex.org/keywords/imitation","display_name":"Imitation","score":0.5884000062942505},{"id":"https://openalex.org/keywords/autonomous-agent","display_name":"Autonomous agent","score":0.5511999726295471},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5379999876022339},{"id":"https://openalex.org/keywords/intrusion","display_name":"Intrusion","score":0.42640000581741333},{"id":"https://openalex.org/keywords/intelligent-agent","display_name":"Intelligent agent","score":0.3917999863624573},{"id":"https://openalex.org/keywords/multi-agent-system","display_name":"Multi-agent system","score":0.36059999465942383}],"concepts":[{"id":"https://openalex.org/C97541855","wikidata":"https://www.wikidata.org/wiki/Q830687","display_name":"Reinforcement learning","level":2,"score":0.715499997138977},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6741999983787537},{"id":"https://openalex.org/C126388530","wikidata":"https://www.wikidata.org/wiki/Q1131737","display_name":"Imitation","level":2,"score":0.5884000062942505},{"id":"https://openalex.org/C13687954","wikidata":"https://www.wikidata.org/wiki/Q4826847","display_name":"Autonomous agent","level":2,"score":0.5511999726295471},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5379999876022339},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.512499988079071},{"id":"https://openalex.org/C158251709","wikidata":"https://www.wikidata.org/wiki/Q354025","display_name":"Intrusion","level":2,"score":0.42640000581741333},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3955000042915344},{"id":"https://openalex.org/C74072328","wikidata":"https://www.wikidata.org/wiki/Q1142726","display_name":"Intelligent agent","level":2,"score":0.3917999863624573},{"id":"https://openalex.org/C41550386","wikidata":"https://www.wikidata.org/wiki/Q529909","display_name":"Multi-agent system","level":2,"score":0.36059999465942383},{"id":"https://openalex.org/C32848918","wikidata":"https://www.wikidata.org/wiki/Q845789","display_name":"Observable","level":2,"score":0.34290000796318054},{"id":"https://openalex.org/C188116033","wikidata":"https://www.wikidata.org/wiki/Q2664563","display_name":"Q-learning","level":3,"score":0.2906999886035919},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.2754000127315521},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2700999975204468},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.2689000070095062},{"id":"https://openalex.org/C9628104","wikidata":"https://www.wikidata.org/wiki/Q788009","display_name":"Autonomous system (mathematics)","level":2,"score":0.26409998536109924},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.26339998841285706}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.18223","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18223","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.18223","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.18223","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.5904449224472046}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"With":[0],"sophisticated":[1],"cyber-attacks":[2],"becoming":[3],"increasingly":[4],"prevalent,":[5],"modern":[6],"networks":[7,46],"require":[8],"intelligent":[9],"autonomous":[10,45,111],"cyber-defense":[11,129],"agents":[12,19,98],"trained":[13],"via":[14],"Reinforcement":[15],"Learning":[16,86],"(RL).":[17],"These":[18],"employ":[20],"neurosymbolic":[21,128],"approaches":[22],"such":[23],"as":[24],"behavior":[25],"trees":[26],"with":[27,99,126],"learning-enabled":[28],"components":[29],"(LECs)":[30],"to":[31,66,91,114],"learn,":[32],"reason,":[33],"adapt,":[34],"and":[35,102,122,138],"implement":[36],"security":[37],"rules":[38],"while":[39],"maintaining":[40],"critical":[41],"operations.":[42],"However,":[43],"these":[44],"are":[47,57],"partially":[48,95],"observable":[49,96],"systems,":[50],"i.e.,":[51],"the":[52,64,75],"cyber-attacker's":[53],"(red":[54],"agent's)":[55],"actions":[56,118],"not":[58],"observable,":[59],"making":[60],"it":[61],"difficult":[62],"for":[63,94],"defender":[65,123],"predict":[67,115],"red":[68,71,116,136],"actions,":[69],"learn":[70,92],"policies,":[72],"or":[73],"assess":[74],"attacker's":[76],"intrusion":[77],"levels.":[78],"To":[79],"address":[80],"this,":[81],"we":[82],"propose":[83],"a":[84,127],"Policy":[85],"Technique":[87],"using":[88],"imitation":[89],"learning":[90],"policies":[93,137],"RL":[97],"discrete":[100,103],"states":[101],"actions.":[104,124],"We":[105],"apply":[106],"this":[107],"technique":[108],"in":[109],"an":[110],"cyber":[112],"environment":[113],"agent's":[117],"from":[119],"network":[120],"observations":[121],"Integrated":[125],"agent,":[130],"our":[131],"method":[132],"effectively":[133],"handles":[134],"different":[135],"achieves":[139],"high":[140],"prediction":[141],"accuracy":[142],"across":[143],"diverse":[144],"simulated":[145],"scenarios.":[146]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-18T00:00:00"}