Autonomous cyber-defense systems can predict attacker actions without directly observing them by learning from network data and defender responses, enabling smarter, adaptive security.
This paper develops a technique for autonomous cyber-defense agents to learn and predict attacker behavior in partially observable networks. Using imitation learning, the system learns what an attacker might do based on network observations, helping defenders anticipate threats and adapt their security strategies in real-time.