What is it about?
This work explores how evolutionary algorithms—inspired by natural selection—can help defend computer networks against cyberattacks without relying on black box solutions. We designed an evolutionary heuristic search method that allows automated defence agents (the “blue team”) to learn effective protection strategies against attackers (the “red team”) in a simulated cyber battlefield.
Featured Image
Photo by Moritz Erken on Unsplash
Why is it important?
Most existing autonomous cyber defence solutions use deep reinforcement learning, which can achieve strong performance but often act as a “black box,” offering little insight into how or why they make decisions. Our approach strikes a balance between human knowledge (encoded as heuristic rules) and machine adaptation (via evolutionary optimization). This makes the resulting defensive policies not only powerful but also interpretable—an essential quality for real-world cybersecurity systems.
Perspectives
What did we find? Through extensive experiments using the TTCP CAGE Challenge 2 (Figure1) framework, we found that an evolutionary heuristic search can effectively optimize defensive strategies while maintaining explicit knowledge of network structure. Our method adapts to distinct attacker behaviours—such as the “B-line” and “Meander” red agents—by evolving specialized policy variations that remain interpretable and efficient. This demonstrates a promising middle ground between expert knowledge-based heuristics and opaque deep learning models. Looking at the official ranking board, our evolved blue team achieved second place among 17 international submissions, all of which are black box. Moreover, in local training environments, our approach consistently outperformed all published solutions, ranking first in measured performance. Who can benefit from this research? This work is valuable for researchers and practitioners in AI for cybersecurity, autonomous agents, and evolutionary computation, as well as organizations exploring automated network protection. It demonstrates that interpretable, knowledge-guided approaches can compete with complex neural systems in high-stakes cyber operations. Takeaway: By combining expert heuristics with evolutionary optimization, we show that cyber defence agents can learn, adapt, and succeed—while staying interpretable and keeping the human expert in the loop.
Yuxuan Wang
Read the Original
This page is a summary of: Discovering Blue Team Solutions for an Autonomous Cyber Operations Challenge using an Evolutionary Heuristic Search, July 2025, ACM (Association for Computing Machinery),
DOI: 10.1145/3712255.3726621.
You can read the full text:
Contributors
The following have contributed to this page
