Discovering Blue Team Solutions for an Autonomous Cyber Operations Challenge using an Evolutionary Heuristic Search

An approach to autonomous network defense is proposed that utilizes an evolutionary strategy to optimize default heuristic agents. The default heuristic agent is used to impart knowledge regarding network architecture, i.e. what the key infrastructure and bottlenecks might be. Evaluation takes place using the TTCP CAGE Challenge 2 framework where there are green (normal user), blue (defense), and red (attack) team agents. Unlike the deep learning solutions that have dominated this challenge, we are able to demonstrate that competitive solutions can be evolved that transfer knowledge from a blue team default heuristic. The resulting combined blue team is able to place second relative to the original 17 entries submitted to the TTCP CAGE Challenge 2 competition while maintaining knowledge of the solution.