CyberBattleSim

Much like a game of capture the flag, it It models how threatening adversaries can move laterally through a network searching for points of weakness. In building the attack simulation, enterprise defenders and researchers created various nodes on a network and indicated which services were running, which vulnerabilities were present, and what type of security controls were in place. Automated agents, representing threat actors, are deployed into the attack simulation to execute actions randomly as they attempt a takeover of the nodes.

The researchers at Microsoft have explored such machine learning algorithms as reinforcement learning, wherein autonomous agents learn how to make decisions in real time based on how the scenario plays out within the simulated environment, to improve the real-life security of information. In this way, the agent's goal is gamified, with bigger and better rewards offered when agents start making better decisions in their repeated attempts.

In the same way that a video game player gets better at playing their game after repeated trials, autonomous agents, whether they be attackers trying to steal info or defenders trying to block attacks and mitigate their effects, are rewarded for their growing success over time.

CyberBattleSim's Python-based Open AI Gym interface compares agent performance based on two metrics:

1. number of simulation steps taken to attain goal

1. cumulative rewards over simulation steps across training epochs