Blue-Red Cyber Coevolution: Archived SHADE with RF Surrogate for Autonomous Defense

Authors

  • Setayesh Zahiri * Morvarid Intelligent Industrial Systems Research Group Iran.
  • Wolfgang H. Müller Department of Computer Science, Technical University of Munich, Munich, Germany.

https://doi.org/10.48313/maa.vi.111

Abstract

Autonomous cyber defense increasingly demands optimizers that can reason under adversarial pressure and quantify the cost of every decision in real time. We introduce BRC-ASHADE-RF, a coevolutionary framework that pairs an archived Success-History based Adaptive Differential Evolution (SHADE) with a Random Forest (RF) surrogate to evolve red-team attack policies and blue-team defense policies in tandem. The archive retains historically successful trial vectors, enabling memory-guided mutation when the operational landscape drifts, while the RF surrogate approximates the expensive fitness evaluation associated with full-scale intrusion simulation. We formalize the coevolutionary dynamics as a coupled Markov chain, derive a convergence-in-probability guarantee under standard regularity assumptions, and bound the surrogate-induced regret. Empirically, BRC-ASHADE-RF is evaluated on CICIDS2017, CTU-13, and the DARPA Transparent Computing Engagement 3 dataset against nine baselines spanning classical evolutionary algorithms, swarm intelligence, and modern DE variants. Across 51 independent runs, the framework improves mean detection rate by 22.5% over the strongest baseline (SHADE), reduces median response latency from 312 ms to 91 ms, and exhibits a Cohen's d exceeding 0.85 in all pairwise comparisons (Holm-corrected p < 0.01). Ablation isolates the contribution of each component, and a multi-dimensional explainability audit using SHAP confirms that the surrogate's attention aligns with established threat indicators. The framework operates within the latency budget required by Software-Defined Networking controllers and is released as a reproducible artifact.

Keywords:

Autonomous cyber defense, Coevolutionary algorithms, Differential evolution, SHADE, Archive-based adaptation, Random forest surrogate, Adversarial learning, Intrusion response, Explainability

References

  1. [1] Tanabe, R., & Fukunaga, A. (2013). Success-history based parameter adaptation for differential evolution. 2013 IEEE Congress on Evolutionary Computation (pp. 71-78). IEEE. https://doi.org/10.1109/CEC.2013.6557555
  2. [2] Tanabe, R., & Fukunaga, A. S. (2014,). Improving the search performance of SHADE using linear population size reduction. 2014 IEEE Congress on Evolutionary Computation (CEC) (pp. 1658-1665). IEEE. https://doi.org/10.1109/CEC.2014.6900380
  3. [3] Zhang, J., & Sanderson, A. C. (2009). JADE: Adaptive differential evolution with optional external archive. IEEE Transactions on Evolutionary Computation, 13(5), 945–958. https://doi.org/10.1109/TEVC.2009.2014613
  4. [4] Breiman, L. (2001). Random forests. Machine learning, 45(1), 5–32. https://doi.org/10.1023/A:1010933404324
  5. [5] Lundberg, S. M., & Lee, S. I. (2017). A unified approach to interpreting model predictions. Advances in Neural Information Processing Systems, 30, 4765–4774. https://proceedings.neurips.cc/paper_files/paper/2017/hash/8a20a8621978632d76c43dfd28b67767-Abstract.html
  6. [6] Jin, Y. (2011). Surrogate-assisted evolutionary computation: Recent advances and future challenges. Swarm and Evolutionary Computation, 1(2), 61–70. https://doi.org/10.1016/j.swevo.2011.05.001
  7. [7] Chugh, T., Jin, Y., Miettinen, K., Hakanen, J., & Sindhya, K. (2016). A surrogate-assisted reference vector guided evolutionary algorithm for computationally expensive many-objective optimization. IEEE Transactions on Evolutionary Computation, 22(1), 129–142. https://doi.org/10.1109/TEVC.2016.2622301
  8. [8] Anjum, M. M., Iqbal, S., & Hamelin, B. (2021). Analyzing the usefulness of the DARPA OpTC dataset in cyber threat detection research. Proceedings of the 26th ACM Symposium on Access Control Models and Technologies (pp. 27-32). Association for Computing Machinery (ACM). https://doi.org/10.1145/3450569.3463573
  9. [9] Xin, Y., Kong, L., Liu, Z., Chen, Y., Li, Y., Zhu, H., ... & Wang, C. (2018). Machine learning and deep learning methods for cybersecurity. IEEE Access, 6, 35365-35381. https://doi.org/10.1109/ACCESS.2018.2836950
  10. [10] Sharafaldin, I., Lashkari, A. H., & Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. ICISSp, 1(2018), 108-116. https://doi.org/10.5220/0006639801080116
  11. [11] Li, G., Zhu, P., Li, J., Yang, Z., Cao, N., & Chen, Z. (2018). Security matters: A survey on adversarial machine learning. https://doi.org/10.48550/arXiv.1810.07339
  12. [12] Tama, B. A., Comuzzi, M., & Rhee, K. H. (2019). TSE-IDS: A two-stage classifier ensemble for intelligent anomaly-based intrusion detection system. IEEE Access, 7, 94497–94507. https://doi.org/10.1109/ACCESS.2019.2928048
  13. [13] Storn, R., & Price, K. (1997). Differential evolution-A simple and efficient heuristic for global optimization over continuous spaces. Journal of Global Optimization, 11(4), 341–359. https://doi.org/10.1023/A:1008202821328
  14. [14] Das, S., Mullick, S. S., & Suganthan, P. N. (2016). Recent advances in differential evolution-An updated survey. Swarm and Evolutionary Computation, 27, 1–30. https://doi.org/10.1016/j.swevo.2016.01.004
  15. [15] Kennedy, J., & Eberhart, R. (1995). Particle swarm optimization. Proceedings of ICNN'95-International Conference on Neural Networks (Vol. 4, pp. 1942-1948). IEEE. https://doi.org/10.1109/ICNN.1995.488968
  16. [16] Holland, J. H. (1975). Adaptation in natural and artificial systems. University of Michigan Press Google Schola, 2, 29–41. https://mitpress.mit.edu/9780262082136/adaptation-in-natural-and-artificial-systems/
  17. [17] Garcia, S., Grill, M., Stiborek, J., & Zunino, A. (2014). An empirical comparison of botnet detection methods. Computers & Security, 45, 100–123. https://doi.org/10.1016/j.cose.2014.05.011
  18. [18] Hansen, N. (2006). The CMA evolution strategy: A comparing review. In Towards A New Evolutionary Computation: Advances in the Estimation of Distribution Algorithms (pp. 75–102). Springer. https://doi.org/10.1007/3-540-32494-1_4
  19. [19] Liu, H., & Lang, B. (2019). Machine learning and deep learning methods for intrusion detection systems: A survey. Applied Sciences, 9(20), 4396. https://doi.org/10.3390/app9204396
  20. [20] Deb, K., Pratap, A., Agarwal, S., & Meyarivan, T. (2002). A fast and elitist multiobjective genetic algorithm: NSGA-II. IEEE Transactions on Evolutionary Computation, 6(2), 182–197. https://doi.org/10.1109/4235.996017
  21. [21] Derrac, J., García, S., Molina, D., & Herrera, F. (2011). A practical tutorial on the use of nonparametric statistical tests as a methodology for comparing evolutionary and swarm intelligence algorithms. Swarm and Evolutionary Computation, 1(1), 3-18. https://doi.org/10.1016/j.swevo.2011.02.002
  22. [22] Friedman, M. (1937). The use of ranks to avoid the assumption of normality implicit in the analysis of variance. Journal of the American Statistical Association, 32(200), 675–701. https://doi.org/10.1080/01621459.1937.10503522
  23. [23] Wilcoxon, F. (1945). Individual comparisons by ranking methods. Biometrics Bulletin, 1(6), 80–83. https://doi.org/10.2307/3001968
  24. [24] Holm, S. (1979). A simple sequentially rejective multiple test procedure. Scandinavian Journal of Statistics, 6(2), 65–70. https://www.jstor.org/stable/4615733
  25. [25] Buczak, A. L., & Guven, E. (2015). A survey of data mining and machine learning methods for cyber security intrusion detection. IEEE Communications Surveys & Tutorials, 18(2), 1153–1176. https://doi.org/10.1109/COMST.2015.2494502
  26. [26] Wolpert, D. H., & Macready, W. G. (1997). No free lunch theorems for optimization. IEEE Transactions on Evolutionary Computation, 1(1), 67–82. https://doi.org/10.1109/4235.585893

Downloads

Published

2026-03-02

Issue

Vol. 3 No. 1 (2026): Metaheuristic Algorithms with Applications (MAA)

Section

Articles

Categories

How to Cite

Zahiri, S., & Müller, W. H. . (2026). Blue-Red Cyber Coevolution: Archived SHADE with RF Surrogate for Autonomous Defense. Metaheuristic Algorithms With Applications, 3(1), 61-80. https://doi.org/10.48313/maa.vi.111

Similar Articles

1-10 of 63

You may also start an advanced similarity search for this article.