  The growing system complexity from microservice architectures and the
bilateral enhancement of artificial intelligence (AI) for both attackers and
defenders presents increasing security challenges for cloud-native operations.
In particular, cloud-native operators require a holistic view of the dynamic
security posture for the cloud-native environment from a defense aspect.
Additionally, both attackers and defenders can adopt advanced AI technologies.
This makes the dynamic interaction and benchmark among different intelligent
offense and defense strategies more crucial. Hence, following the multi-agent
deep reinforcement learning (RL) paradigm, this research develops an
agent-based intelligent security service framework (ISSF) for cloud-native
operation. It includes a dynamic access graph model to represent the
cloud-native environment and an action model to represent offense and defense
actions. Then we develop an approach to enable the training, publishing, and
evaluating of intelligent security services using diverse deep RL algorithms
and training strategies, facilitating their systematic development and
benchmark. The experiments demonstrate that our framework can sufficiently
model the security posture of a cloud-native system for defenders, effectively
develop and quantitatively benchmark different services for both attackers and
defenders and guide further service optimization.
