这篇论文用模仿学习帮防守方预测攻击者行动，在模拟网络攻防场景下准确率很高。
本文提出一种基于模仿学习的策略学习技术，用于在部分可观测的自主网络环境中预测红方（攻击方）动作。该方法适用于离散状态和离散动作的强化学习智能体。集成到使用行为树和LECs的神经符号自主防御智能体后，该方法能有效处理不同红方策略，并在多种模拟场景下实现高预测准确率。
Learning Red Agent Policy from Observations for Neurosymbolic Autonomous Cyber Agents
With sophisticated cyber-attacks becoming increasingly prevalent, modern networks require intelligent autonomous cyber-defense agents trained via Reinforcement Learning (RL). These agents employ neurosymbolic approaches such as behavior trees with learning-enabled components (LECs) to learn, reason, adapt, and implement security rules while maintaining critical operations. However, these autonomous networks are partially observable systems, i.e., the cyber-attacker's (red agent's) actions are not observable, making it difficult for the defender to predict red actions, learn red policies, or assess the attacker's intrusion levels. To address this, we propose a Policy Learning Technique using imitation learning to learn policies for partially observable RL agents with discrete states and discrete actions. We apply this technique in an autonomous cyber environment to predict red agent's actions from network observations and defender actions. Integrated with a neurosymbolic cyber-defense agent, our method effectively handles different red policies and achieves high prediction accuracy across diverse simulated scenarios.