Authors: R Gayathri, Rohith V, M Mugilvannan
Abstract: Sophisticated assailants outperform human defenders in today's cyber networks. This project introduces AEGIS, an end-to-end autonomous cyber operations system that integrates Large Language Models (LLMs) with Multi-Agent Deep Reinforcement Learning (MADRL) within the CybORG++ environment to overcome human latency and inflexible rule-based systems. AEGIS competes in a zero-sum game between an autonomous Blue Agent defense (Microsoft Phi-3.5-mini) and a Red Agent attacker (Qwen2.5-Coder-3B) using an Independent Learners technique under Decentralized Training and Decentralized Execution (DTDE). The system has a fully integrated 7-level progressive training pipeline with threshold-separated ChromaDB episodic memories, prioritized replay buffers, and LLM-specific action masking to remove hallucinations. The system uses a distributed MARL architecture that performs LoRA fine-tuning over two physical nodes via direct Ethernet, guaranteeing total parameter isolation, in order to maximize performance under stringent hardware restrictions. In the end, this architecture effectively illustrates how LLM agents with curriculum learning and episodic memory can independently learn intricate, multi-subnet cyber security tactics in sophisticated simulated environments.
DOI: http://doi.org/10.5281/zenodo.20582330
