ACD-G: Enhancing Autonomous Cyber Defence Agent Generalisation Through Graph Embedded Network Representation

The adoption of autonomous cyber defence agents within real-world contexts requires them to be able to cope with differences between their training and target environments, bridging the simulation to real gap, in order to provide robust, generalised defensive responses. Whilst the simulation to real gap has been studied in-depth across domains such as robotics to date there has been minimal research considering generalisability in the context of cyber defence agents and how differences in observation space could enhance agent generalisability when placed into environments that differ from the training environment. Within this paper, we propose a method of enhancing agent generalisability and performance within unseen environments by integrating a graph embedded network representation into the agents observation space. We then compare agent performance with and without a graph embedded network representation based observation space within a series of randomised cyber defence simulations. We find that there is a trade off between the effectiveness of the graph embedding representation and the complexity of the graph, in terms of node count and number of edges.