Blue-Red Cyber Coevolution: Archived SHADE with RF Surrogate for Autonomous Defense

Abstract

Autonomous cyber defense increasingly demands optimizers that can reason under adversarial pressure and quantify the cost of every decision in real time. We introduce BRC-ASHADE-RF, a coevolutionary framework that pairs an archived Success-History based Adaptive Differential Evolution (SHADE) with a Random Forest (RF) surrogate to evolve red-team attack policies and blue-team defense policies in tandem. The archive retains historically successful trial vectors, enabling memory-guided mutation when the operational landscape drifts, while the RF surrogate approximates the expensive fitness evaluation associated with full-scale intrusion simulation. We formalize the coevolutionary dynamics as a coupled Markov chain, derive a convergence-in-probability guarantee under standard regularity assumptions, and bound the surrogate-induced regret. Empirically, BRC-ASHADE-RF is evaluated on CICIDS2017, CTU-13, and the DARPA Transparent Computing Engagement 3 dataset against nine baselines spanning classical evolutionary algorithms, swarm intelligence, and modern DE variants. Across 51 independent runs, the framework improves mean detection rate by 22.5% over the strongest baseline (SHADE), reduces median response latency from 312 ms to 91 ms, and exhibits a Cohen's d exceeding 0.85 in all pairwise comparisons (Holm-corrected p < 0.01). Ablation isolates the contribution of each component, and a multi-dimensional explainability audit using SHAP confirms that the surrogate's attention aligns with established threat indicators. The framework operates within the latency budget required by Software-Defined Networking controllers and is released as a reproducible artifact.