  Development of autonomous cyber system defense strategies and action
recommendations in the real-world is challenging, and includes characterizing
system state uncertainties and attack-defense dynamics. We propose a
data-driven deep reinforcement learning (DRL) framework to learn proactive,
context-aware, defense countermeasures that dynamically adapt to evolving
adversarial behaviors while minimizing loss of cyber system operations. A
dynamic defense optimization problem is formulated with multiple protective
postures against different types of adversaries with varying levels of skill
and persistence. A custom simulation environment was developed and experiments
were devised to systematically evaluate the performance of four model-free DRL
algorithms against realistic, multi-stage attack sequences. Our results suggest
the efficacy of DRL algorithms for proactive cyber defense under multi-stage
attack profiles and system uncertainties.
