Accounting for the Impact of Real-World Data and Costs in Autonomous Cyber Defence

In cyber operations, a robust and versatile cyber defence system is vital. The introduction of machine learning techniques has reduced the cognitive load on human analysts who protect these networks, whilst also enabling machine speed response times. However, these proposed models often operate in isolation, neglecting the broader real-world context. This paper aims to address this gap by demonstrating how to incorporate real-world context into autonomous cyber defence agents. We first developed a simulated air defence network, to adapt cyber defence policies according to real-world conditions. We then employed Gaussian Processes to enable our autonomous agent to learn from data about both the network and real-world parameters, influencing its decision-making capabilities. Our evaluation demonstrates that it is feasible to incorporate realworld data and costs into cyber defence decision-making. This approach aligns cyber defence efforts with broader real-world objectives, highlighting the importance of considering the wider context in cyber defence strategies.