  This report summarizes the discussions and findings of the Workshop on
Intelligent Autonomous Agents for Cyber Defence and Resilience organized by the
NATO research group IST-152-RTG. The workshop was held in Prague, Czech
Republic, on 18-20 October 2017. There is a growing recognition that future
cyber defense should involve extensive use of partially autonomous agents that
actively patrol the friendly network, and detect and react to hostile
activities rapidly (far faster than human reaction time), before the hostile
malware is able to inflict major damage, evade friendly agents, or destroy
friendly agents. This requires cyber-defense agents with a significant degree
of intelligence, autonomy, self-learning, and adaptability. The report focuses
on the following questions: In what computing and tactical environments would
such an agent operate? What data would be available for the agent to observe or
ingest? What actions would the agent be able to take? How would such an agent
plan a complex course of actions? Would the agent learn from its experiences,
and how? How would the agent collaborate with humans? How can we ensure that
the agent will not take undesirable destructive actions? Is it possible to help
envision such an agent with a simple example?
