Large Language Models are Autonomous Cyber Defenders

TL;DR

This paper investigates the use of Large Language Models in multi-agent autonomous cyber defense, highlighting their potential for explainability and interaction with reinforcement learning agents in simulated environments.

Contribution

It introduces a novel integration of LLMs into multi-agent cyber defense scenarios and proposes a communication protocol for LLM and RL agent collaboration.

Findings

LLMs can provide explainable actions in cyber defense.

Multi-agent interactions reveal strengths and weaknesses of LLMs and RL.

New environment integration enables future research on team-based ACD.

Abstract

Fast and effective incident response is essential to prevent adversarial cyberattacks. Autonomous Cyber Defense (ACD) aims to automate incident response through Artificial Intelligence (AI) agents that plan and execute actions. Most ACD approaches focus on single-agent scenarios and leverage Reinforcement Learning (RL). However, ACD RL-trained agents depend on costly training, and their reasoning is not always explainable or transferable. Large Language Models (LLMs) can address these concerns by providing explainable actions in general security contexts. Researchers have explored LLM agents for ACD but have not evaluated them on multi-agent scenarios or interacting with other ACD agents. In this paper, we show the first study on how LLMs perform in multi-agent ACD environments by proposing a new integration to the CybORG CAGE 4 environment. We examine how ACD teams of LLM and RL agents can interact by proposing a novel communication protocol. Our results highlight the strengths and weaknesses of LLMs and RL and help us identify promising research directions to create, train, and deploy future teams of ACD agents.