CSLE: A Reinforcement Learning Platform for Autonomous Security Management

Dimensions overall score 7.0

• strategies for four security management tasks: flow con- trol, replication control, segmentation control, and recovery control. Through these use cases, we show that CSLE en- ables autonomous security management in an environment that closely approximates an operational system. Moreoverclaim 82%
• strategies through reinforcement learning, and transferring strategies from simulation to emulation. None of these func- tions is provided by ITBench and AIOpsLab. 4 ARCHITECTURE OFCSLE The architecture of CSLE is illustrated in Fig. 1 and is centered around an emulation system for creating a digital twin, i.e.claim 82%
• Reinforcement learning is a promising approach to autonomous and adaptive security management in networked systems. However, current reinforcement learning solutions for security management are mostly limited to simulation environments and it is unclear how they generalize to operational systems. In this paperclaim 82%
• Over the past 5 years, several reinforcement learning envi- ronments for autonomous security management have been developed. They include CyberBattleSim by Microsoft (Blum, 2021), CyBorg by the Australian department of defense (Standen et al., 2021), NaSim by the University of Queensland (Schwartz et al., 2020)claim 82%
• & Stadler, 2020), MAB-Malware by the University of Cali- fornia (Riverside) (Song et al., 2022), Malware-RL by the University of Virginia (Anderson et al., 2018), PenGym by Japan’s advanced institute of science and technology (Huynh Phuong Thanh et al., 2024)claim 82%
• vides infrastructure for automating reinforcement learning experiments and debugging the learned strategies. Lastly, we note that a few platforms for autonomous sys- tem operations based on large language models (LLMs) have recently emerged, most notably ITBench (Jha et al., 2025) and AIOpsLab (Chen et al., 2025)claim 82%
• The Cyber Security Learning Environment (CSLE) ing reinforcement learning agents. This difference in scope leads to fundamental differences in platform architecture. In particular, LLMs do not require the same system-level support as reinforcement learning agents do. For example,claim 82%