Learning Optimal Defender Strategies for CAGE-2 using a POMDP Model
Abstract
CAGE-2 is an accepted benchmark for learning and evaluating defender strategies against cyberattacks. It reflects a scenario where a defender agent protects an IT infrastructure against various attacks. Many defender methods for CAGE-2 have been proposed in the literature. In this paper, we construct a formal model for CAGE-2 using the framework of Partially Observable Markov Decision Process (POMDP). Based on this model, we define an optimal defender strategy for CAGE-2 and introduce a method to efficiently learn this strategy. Our method, called BF-PPO, is based on PPO, and it uses particle filter to mitigate the computational complexity due to the large state space of the CAGE-2 model. We evaluate our method in the CAGE-2 CybORG environment and compare its performance with that of CARDIFF, the highest ranked method on the CAGE-2 leaderboard. We find that our method outperforms CARDIFF regarding the learned defender strategy and the required training time.
Cite
@article{arxiv.2509.06539,
title = {Learning Optimal Defender Strategies for CAGE-2 using a POMDP Model},
author = {Duc Huy Le and Rolf Stadler},
journal= {arXiv preprint arXiv:2509.06539},
year = {2026}
}
Comments
The paper is accepted for the 21st International Conference on Network and Service Management (CNSM-2025) and the official version is published in the conference proceedings