Ashfaaq Farzaan

Cyber Defense Sim 🕹️

🕹️ Project Overview

Cyber Defense Sim is a specialized practice range for cyber defense decisions. It allows security professionals and AI agents to train in simulated network environments without the risks or costs associated with live networks.

Instead of waiting for real incidents or deploying costly live ranges, Cyber Defense Sim provides a sandbox where you can describe a small network incident in a simple YAML file. From there, you can either play the defender yourself or train an autonomous agent to respond.

🚀 Key Features

  • 🧠 RL Environments: Fully integrated with Gymnasium and Stable-Baselines3, allowing you to train agents (e.g., using PPO) to learn optimal incident response policies.
  • ⚡ Fast, Safe Simulation: The simulator models state only. It never scans a host, runs a command against a target, exploits software, or touches a real network, allowing you to run thousands of scenarios in seconds.
  • 🛠️ Realistic Decision Making: Each turn, defenders must act on imperfect information (alerts vs. truth) and choose from actions like investigate, isolate, patch, block, or restore — balancing the cost of action against the risk of the attacker spreading.

🧪 How it Works

The core of the simulation revolves around the balance of information and action. Compromised machines raise alerts, but so do clean machines occasionally.

You must decide whether to spend a turn confirming a suspicion or acting immediately. Investigating reveals the truth but costs time, isolating a clean machine costs points, and doing nothing lets the attacker move further. This dynamic accurately reflects the high-stakes, imperfect-information environment of real-world Security Operations Centers (SOC).

🔗 Explore the Repository