AD-CTIDRL: a multi-agent method for threat intelligence-enhanced automated cyber defense

The increasing severity and frequency of cyberattacks pose significant challenges to real-world network systems, especially in rapidly evolving environments. Recent advances in automated defense methods have improved rapid threat detection, incident response, and decision-making processes. However, most existing methods still rely on predefined action spaces and static data for training and prediction purposes, which limits their ability to detect and mitigate emerging threats in a timely manner. We propose AD-CTIDRL, a multi-agent automated defense method that grounds Structured Threat Information Expression (STIX)-formatted cyber threat intelligence (CTI) into Open Command and Control (OpenC2)-compatible executable decision options for reinforcement-learning defenders. In AD-CTIDRL, the large language model (LLM)-based CTI analysis agent performs configuration-aware grounding of CTI into executable policy options, and the proximal policy optimization (PPO)-based defense agents use the resulting CTI-conditioned decision interface to select defense actions. We further design and implement a multi-agent PPO-based defense framework that classifies attack types and automatically generates and optimizes defense strategies. Experimental results show that AD-CTIDRL attains significantly enhanced defense performance, achieving reward improvements of 60.05%, 47.76%, 44.11%, and 28.63% over those of TL-Embedding, Ensemble, TL-PPO, and HIPPO, respectively. These results suggest that grounding semantic CTI into executable policy options improves the relevance of automated defense decisions while preserving PPO-compatible policy learning in evolving threat environments.