Towards Autonomous Cyber Defence: Integrating Artificial Intelligence for Intelligent Threat Response

Abstract

Cyber attacks are increasing at an alarming rate and surpassing the traditional means of fighting off human-driven security, which therefore requires automatic defense. The paper introduces a framework that includes artificial intelligence to use intelligent threat response by incorporating a Graph Attention Network-based reinforcement learning agent, as well as a query fragment caching mechanism. On CSE-CIC-IDS2018, CIC-IDS2017, and DARPA Transparent Computing datasets, the proposed system is able to achieve a detection rate of 98.7 percent, a decrease in mean response time of 67.4 percent as compared to traditional SOAR platforms, and a cache hit rate of 78.3 percent. Relative comparison reveals that there was an improvement in stage-weighted F1-score of 21.9% compared to baseline deep reinforcement learning methods. The outcomes show that autonomous AI agents are capable of effectively protecting digital assets at machine speed without being fragile to adversarial evasion efforts.