CSLE: A Reinforcement Learning Platform for Autonomous Security Management#

Kim Hammar (affiliation not listed in the program)

• Why: RL for security has been stuck in toy simulators for years. CSLE's emulate→model→simulate→refine loop is a serious attempt to bridge toward operational systems, and its use cases (flow control, replication control, segmentation control, recovery control) are network-adjacent controls.
• What: A platform pairing an emulation system that replicates target components in a virtualized environment (used to gather measurements/logs and identify an MDP system model) with a simulation system where security strategies are learned, then validated back in emulation. Demonstrated across four use cases with near-optimal management in an environment approximating an operational system (from abstract only).
• How: Emulation-grounded system identification → simulation-based policy learning → emulation-based refinement, closing the sim-to-real gap that plagues pure-simulation RL security work.
• Where applicable: Research platform, not a production control loop — "approximates an operational system" is the honest limit. Interesting for the segmentation/recovery control formulations and the methodology, not for deployable policies.