SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2026
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866908822786801664 |
|---|---|
| author | McFadden, Shae Foley, Myles Bates, Elizabeth Tsingenopoulos, Ilias Vyas, Sanyam Mavroudis, Vasilios Hicks, Chris Pierazzi, Fabio |
| author_facet | McFadden, Shae Foley, Myles Bates, Elizabeth Tsingenopoulos, Ilias Vyas, Sanyam Mavroudis, Vasilios Hicks, Chris Pierazzi, Fabio |
| contents | Deep Reinforcement Learning (DRL) has achieved remarkable success in domains requiring sequential decision-making, motivating its application to cybersecurity problems. However, transitioning DRL from laboratory simulations to bespoke cyber environments can introduce numerous issues. This is further exacerbated by the often adversarial, non-stationary, and partially-observable nature of most cybersecurity tasks. In this paper, we identify and systematize 11 methodological pitfalls that frequently occur in DRL for cybersecurity (DRL4Sec) literature across the stages of environment modeling, agent training, performance evaluation, and system deployment. By analyzing 66 significant DRL4Sec papers (2018-2025), we quantify the prevalence of each pitfall and find an average of over five pitfalls per paper. We demonstrate the practical impact of these pitfalls using controlled experiments in (i) autonomous cyber defense, (ii) adversarial malware creation, and (iii) web security testing environments. Finally, we provide actionable recommendations for each pitfall to support the development of more rigorous and deployable DRL-based security systems. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2602_08690 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity McFadden, Shae Foley, Myles Bates, Elizabeth Tsingenopoulos, Ilias Vyas, Sanyam Mavroudis, Vasilios Hicks, Chris Pierazzi, Fabio Machine Learning Cryptography and Security Deep Reinforcement Learning (DRL) has achieved remarkable success in domains requiring sequential decision-making, motivating its application to cybersecurity problems. However, transitioning DRL from laboratory simulations to bespoke cyber environments can introduce numerous issues. This is further exacerbated by the often adversarial, non-stationary, and partially-observable nature of most cybersecurity tasks. In this paper, we identify and systematize 11 methodological pitfalls that frequently occur in DRL for cybersecurity (DRL4Sec) literature across the stages of environment modeling, agent training, performance evaluation, and system deployment. By analyzing 66 significant DRL4Sec papers (2018-2025), we quantify the prevalence of each pitfall and find an average of over five pitfalls per paper. We demonstrate the practical impact of these pitfalls using controlled experiments in (i) autonomous cyber defense, (ii) adversarial malware creation, and (iii) web security testing environments. Finally, we provide actionable recommendations for each pitfall to support the development of more rigorous and deployable DRL-based security systems. |
| title | SoK: The Pitfalls of Deep Reinforcement Learning for Cybersecurity |
| topic | Machine Learning Cryptography and Security |
| url | https://arxiv.org/abs/2602.08690 |