The literature on autonomous defense splits roughly into three threads. The first treats the problem as supervised classification, where labeled traffic trains a detector that fires on anomalous packets. Surveys by Anjum et al. [8] and Xin et al. [9] catalog the breadth of classical and deep methods applied to intrusion detection, while Sharafaldin et al. [10] constructed the CICIDS2017 dataset specifically to address the limitations of older corpora such as KDD'99. Li et al. [11] extend the review to deep models, and Tama et al. [12] provide a critical inventory of available datasets, noting that few support rigorous temporal validation. These works establish the empirical substrate our experiments rely on but do not address the dynamic, adversarial nature of the threat.

The second thread models the attacker-defender interaction as a game. Stackelberg games, signaling games, and stochastic games have all been applied to security resource allocation, with the attacker as leader and defender as follower or vice versa. While game-theoretic treatments yield clean equilibrium concepts, they typically assume known utility structures and small action spaces, assumptions that rarely hold in operational networks. Our coevolutionary formulation relaxes both: Utilities are revealed only through noisy fitness evaluations, and action spaces are continuous encodings of policy parameters.

The third thread is Moving Target Defense (MTD) and adaptive honeypots, where the defender actively reshapes the attack surface. MTD schemes randomize host addresses, port assignments, or code layouts; adaptive honeypots mutate their emulated services to confuse reconnaissance. These mechanisms provide the defensive actions our blue population optimizes over, but in isolation they lack a learning loop that conditions future mutations on observed attack success. BRC-ASHADE-RF supplies that loop. A fourth, more recent thread treats intrusion response as a reinforcement learning problem, where an agent learns to take response actions that maximize a long-horizon reward. These approaches are promising but suffer from sample inefficiency: The agent must explore a combinatorial action space against an adversary whose distribution shifts in response. Our framework is a population-based alternative that replaces single-agent RL with coevolution, inheriting the global-search properties of evolutionary computation while preserving the adversarial coupling that RL captures explicitly.

Coevolutionary algorithms evolve two or more populations whose fitness is defined relative to one another. Competitive coevolution, where one population's gain is another's loss, was popularized in the 1990s through applications to game-playing agents and predator-prey dynamics. The cybersecurity application is natural: Red and blue teams are textbook competitors. Yet only a handful of papers operationalize the idea at scale. Most use Genetic Algorithms (GAs) with bit-string encodings that fail to capture the continuous components of modern attack and defense strategies, timing parameters, threshold values, and mutation magnitudes.

A persistent difficulty is fitness dilution. When one population dominates, the other's fitness signal collapses, and the search degenerates into a random walk. Hall of fame mechanisms and Pareto-based coevolution have been proposed as remedies, but neither addresses the underlying evaluation cost. Our archive-elitism strategy indirectly mitigates dilution by retaining informative mutants from prior adversarial regimes, even when the opposing population's current incarnation offers little gradient.

DE, introduced by Storn and Price [13], remains one of the most effective continuous optimizers for non-convex landscapes. Its mutation operator constructs a donor vector by adding a scaled difference between two population members to a third. The crossover and selection steps preserve diversity while exploiting local structure. Two limitations motivate adaptive variants: The scaling factor F and crossover rate CR are problem-dependent, and the difference operator becomes uninformative as the population converges.

JADE [3] introduced the optional external archive precisely to address the second limitation. By retaining recently discarded parents in an archive, JADE provides additional difference vectors that preserve directional information as the live population narrows. SHADE [1] replaced JADE's greedy parameter adaptation with a success-history mechanism: A memory of recent successful F and CR values, drawn through Lehmer mean, governs the next generation. L-SHADE [2] added linear population size reduction, which improves performance on high-dimensional benchmarks. The comprehensive survey by Das et al. [14] situates these developments within the broader DE landscape and documents the superiority of archive-equipped variants on CEC benchmark suites.

BRC-ASHADE-RF extends this lineage in three ways. The archive is shared between red and blue populations, allowing cross-population transfer of useful mutations. Archive entries are credit-weighted by their recent contribution to offspring survival, so stale entries decay naturally rather than persisting indefinitely. Finally, the surrogate filters candidate offspring before archive insertion, preventing the archive from accumulating low-quality individuals.

Surrogate-assisted evolutionary algorithms replace expensive fitness evaluations with cheap approximations learned from past evaluations. Jin's [6] survey distinguishes between individual-based and generation-based management strategies, and Chugh et al. [7] demonstrate the approach on many-objective problems. Common surrogate models include Gaussian processes, radial basis functions, polynomial regression, and RFs. Gaussian processes dominate the low-dimensional regime because of their calibrated uncertainty, but they scale poorly beyond a few thousand training points and require careful kernel design.

RFs [4] trade some uncertainty calibration for substantial gains in training and inference speed, robustness to mixed feature types, and natural support for feature-importance explanations. These properties align with operational cybersecurity requirements: Training points accumulate continuously, features are heterogeneous (numeric thresholds alongside categorical action labels), and security operations centers require post-hoc explanations for every automated decision. Surrogate-assisted variants of DE have been reported, but none, to our knowledge, integrate RF with archived SHADE in a coevolutionary setting.

The preceding review surfaces four gaps: 1) autonomous cyber defense systems are evaluated as static classifiers rather than as policies that must anticipate adaptive adversaries, 2) coevolutionary algorithms applied to security rarely use modern adaptive DE variants and rarely use archives, 3) surrogate-assisted optimization has been studied extensively for engineering benchmarks but not for the mixed-type, drift-prone encodings characteristic of intrusion response, and 4) reproducibility artifacts are uncommon: Most studies report aggregate accuracy without releasing seeds, hyperparameters, or statistical analysis code.

BRC-ASHADE-RF addresses all four. Table 1 positions the proposed method against representative existing algorithms along five dimensions: Adaptive parameter control, archive mechanism, surrogate assistance, coevolutionary structure, and reproducibility package. The combination is novel; each individual property has precedent.

BRC-ASHADE-RF maintains two populations in parallel. The red population R = {r_1, ..., r_N} encodes attack policies; the blue population B = {b_1, ..., b_N} encodes defense policies. Each policy is a real-valued vector in [0,1]^d that parameterizes a deployable behavior. For red individuals, the vector controls packet-rate, evasion jitter, payload mutation rate, and exploit chain composition. For blue individuals, it controls detection thresholds, MTD trigger sensitivity, isolation aggressiveness, and response playbook selection. Encoding details appear in Section 4.

The threat model assumes an external adversary with knowledge of the defender's feature space but not of the trained surrogate or the archive contents. Adversarial examples may be crafted against the deployed detector but are evaluated against the emulator, not the surrogate. This asymmetry is intentional: the surrogate guides search, but the operational decision rests on high-fidelity evaluation, which closes the loop against surrogate-aware evasion. The adversary is further assumed to operate within the standard kill-chain taxonomy: reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and action on objectives. Each stage produces observable features that the blue policy can act on, and the red policy is rewarded for progressing as far along the chain as possible while minimizing observable deviation from benign traffic.

Fig. 1 shows the framework. The cyber operational environment sits at the top and exposes datasets and emulation endpoints. Red and blue populations occupy the middle layer; the bidirectional arrow indicates coevolutionary pressure. The RF surrogate at the bottom approximates fitness for candidate offspring, returning only the most promising individuals to full evaluation.

Each generation proceeds in two phases. In the red phase, every red individual r_i is evaluated against the current blue champion b* (the fittest blue individual from the previous generation). Fitness rewards attacks that evade detection while remaining stealthy. In the blue phase, every blue individual b_j is evaluated against the red champion r*, with fitness rewarding fast detection and minimal false-positive cost. The two phases alternate, with the archive seeded by both populations. Fig. 2 sketches the cycle.

Formally, the coupled dynamics define a Markov chain over the joint state (R_t, B_t, A_t), where A_t is the archive at generation t. The transition kernel factors as P(R_{t+1} | R_t, B_t, A_t) · P(B_{t+1} | R_{t+1}, B_t, A_t) · P(A_{t+1} | R_{t+1}, B_{t+1}, A_t). The factorization reflects the within-generation ordering: red updates first, then blue, then the archive absorbs successful trial vectors from both. Section 6 establishes that under standard regularity, this chain has a unique absorbing state corresponding to global optimality.

Each population evolves via archived SHADE. For a target individual x_i, a mutant v_i is constructed as

v_i = x_{r1} + F_i · (x_{r2} - x_{r3}) + F_i · (x̂_a - x_i). (1)

Here x_{r1}, x_{r2}, x_{r3} are distinct population members drawn uniformly at random; x̂_a is an archived individual selected by tournament of size two; and F_i is a scaling factor drawn from a Cauchy distribution whose location parameter is the Lehmer mean of recent successful F values. The third term implements archive-guided mutation, distinct from JADE's use of the archive as a difference-vector source. Eq. (1) extends the canonical SHADE operator with an explicit attractor term toward historically useful mutants, which proved critical under concept drift.

F_i ~ Cauchy(μ_F, 0.1), CR_i ~ Normal(μ_CR, 0.1). (2)

The location parameters μ_F and μ_CR are updated after each generation via the Lehmer mean of successful values, weighted by fitness improvement. Following Tanabe and Fukunaga [1], we use the Lehmer mean for F (which biases toward larger, more exploratory values) and the arithmetic mean for CR (which reflects the typical crossover rate that worked). Archive size |A| is set to N; when full, new entries replace the oldest credit-weighted entry.

μ_F^{t+1} = (Σ s_k · F_k^2) / (Σ s_k · F_k), μ_CR^{t+1} = (Σ s_k · CR_k) / Σ s_k. (3) Crossover is binomial, producing the trial vector u_i. Selection compares u_i against the target x_i on coevolutionary fitness, with ties broken in favor of the trial to encourage exploration. Surviving trials that defeat their targets are inserted into the archive with a credit score initialized to the fitness improvement they produced. Credit decays multiplicatively each generation by a factor η ∈ (0, 1), so entries that no longer produce useful offspring drift to zero and are evicted. This explicit forgetting mechanism addresses a known weakness of fixed archives, which accumulate stale vectors in non-stationary environments.

The surrogate predicts fitness for a candidate offspring given its parameter vector and the current opposing champion. Training data accumulate online: every full evaluation produces a (feature, fitness) pair that is added to a sliding window of size W. We retrain the RF every K generations on the current window, with K=10 by default. We use 100 trees with max_depth=12 and min_samples_leaf=5, parameters selected by 5- fold cross-validation on a held-out emulation trace. The forest returns both a mean prediction μ̂(x) and a standard deviation σ̂(x) from the variance across trees.

Offspring filtering follows an upper-confidence-bound rule. A trial vector u_i is committed to full evaluation only if

μ̂(u_i) + κ · σ̂(u_i) ≥ τ_t. (4)

where κ controls exploration in surrogate space, and τ_t is a quantile threshold adapted to the current generation's fitness distribution. Setting κ > 0 ensures that the surrogate does not over-exploit regions of high predicted fitness at the expense of uncertain but potentially informative samples. The threshold τ_t is set to the 70th percentile of surrogate predictions for the current offspring pool, which empirically retains roughly 30% of candidates for full evaluation.

Surrogate error is bounded by the standard deviation estimate, which also serves as an uncertainty signal for active learning. When σ̂(u_i) exceeds a secondary threshold σ_max, the individual is automatically committed to full evaluation regardless of its predicted mean, ensuring that the surrogate retrains on regions where it is least confident. This mechanism prevents the surrogate from collapsing into a self-reinforcing local optimum, a failure mode documented in earlier surrogate-assisted EAs [6].

Algorithm 1 presents the complete BRC-ASHADE-RF procedure. The outer loop alternates red and blue phases; each phase performs SHADE-style mutation, surrogate-filtered evaluation, and archive update. The termination criterion combines a maximum generation count T_max with a stagnation detector that halts if the coevolutionary equilibrium has not improved for T_stag consecutive generations.

Algorithm 1. BRC-ASHADE-RF.

Input: Population size N, max generations T_max, stagnation T_stag, dimension d, archive size |A|=N, RF retraining interval K, exploration κ, quantile threshold τ Output: Blue champion b* (deployable defense policy) 1: Initialize R_0, B_0 uniformly in [0,1]^d; A_0 ← ∅; t ← 0 2: Evaluate R_0 and B_0 on emulator; train RF_0 3: while t < T_max and not stagnated do 4: // Red phase 5: for each r_i ∈ R_t do 6: Sample F_i, CR_i from Eq. (2) 7: Construct mutant v_i via Eq. (1) using current archive A_t 8: Apply binomial crossover: u_i ← crossover(r_i, v_i, CR_i) 9: Query RF_t: (μ̂, σ̂) ← RF_t(u_i, b*_t) 10: if μ̂ + κσ̂ ≥ τ_t or σ̂ ≥ σ_max then 11: f ← Evaluate(u_i, b*_t) // expensive emulator call 12: Update sliding window D ← D ∪ {(u_i, b*_t, f)} 13: if f > fitness(r_i) then R_{t+1}[i] ← u_i; insert (u_i, credit=f-fitness(r_i)) into A_t 14: else r_i retained // surrogate rejected 15: r*_{t+1} ← argmax fitness in R_{t+1} 16: // Blue phase (symmetric, against r*_{t+1}) 17: Repeat lines 5–15 with B_t and r*_{t+1} to produce B_{t+1}, b*_{t+1} 18: Decay archive credits: credit(a) ← η · credit(a) for all a ∈ A_t 19: if t mod K == 0 then retrain RF_{t+1} on D 20: t ← t + 1 21: end while 22: return b*_t

Per generation, the red phase performs N mutation/crossover operations (each O(d)), N surrogate queries (each O(T_RF · d · log d) for T_RF trees), and at most qN full evaluations (each O(E(d)) where E depends on emulator fidelity). The blue phase is symmetric. Total per-generation complexity is therefore

O(N · d) + O(N · T_RF · d · log d) + O(2qN · E(d)) + O(N · log N). (5)

where q is the surrogate acceptance rate (empirically ≈ 0.3); the dominant term depends on the regime. When E(d) is large, typical for high-fidelity network emulation, the qNE(d) term dominates, and surrogate filtering yields a 1/q ≈ 3.3× speedup. When E(d) is small (fast analytic benchmarks), the RF query dominates, but its cost remains substantially below full evaluation. Space complexity is O(Nd) for each population plus O(|A|d) = O(Nd) for the archive and O(T_RF · d) for the surrogate, totaling O(Nd). This argument is comparable to L-SHADE and substantially below memory-intensive variants such as CMA-ES with full covariance.

Three datasets span the spectrum from laboratory to operational settings. CICIDS2017 [10] provides labeled benign and malicious traffic captured on a controlled testbed with realistic background traffic. CTU-13 [17] contains botnet traffic mixed with normal background traffic from a university network, offering more heterogeneous conditions. The DARPA Transparent Computing Engagement 3 dataset [DARPA] supplies multi-host attack traces with provenance graphs, which we use for the coevolutionary equilibrium analysis because its red-team activities span multiple stages of the kill chain.

Feature extraction follows standard practice. We aggregate network flows into 1-second windows; for each window, we compute 41 features spanning volume, timing, protocol mix, and payload entropy. We one-hot encode categorical features (protocol, service) and min-max scale continuous features. For the red population, the policy vector controls the proportion of each flow type, the timing jitter distribution, and the mutation rate applied to payload bytes. For the blue population, it controls per-class detection thresholds, MTD trigger sensitivity, and the response playbook selector.

Evaluation is partitioned temporally. We split each dataset into 60% training, 20% validation, and 20% test, with the test split drawn from a later capture window to simulate distribution shift. We compute all reported metrics on the test split; we use the validation split only for early stopping and hyperparameter selection.

Nine baselines span four algorithmic families. From swarm intelligence: Particle Swarm Optimization (PSO) [15], Grey Wolf Optimizer (GWO) [18], and Harris Hawks Optimization (HHO) [19]. From evolutionary computation: The canonical GA [16] and NSGA-II [20]. From DE: Classical DE [13], JADE [3], SHADE [1], and L-SHADE [2]. From evolution strategies: CMA-ES. We implement all baselines in their canonical form using author-recommended parameters; BRC-ASHADE-RF uses the defaults listed in Table 2.

Max generations T_max 500 Sufficient for convergence on all benchmarks Stagnation window T_stag 50 Halts once equilibrium is reached Archive size |A| 50 Equal to population size Credit decay η 0.95 Slow forgetting; preserves useful mutants RF trees T_RF 100 Balances accuracy and query cost RF max depth — 12 Captures feature interactions Surrogate retraining K 10 Stabilizes predictions Exploration coefficient κ 0.5 UCB-style exploration in surrogate space Quantile threshold τ 70th pct Retains ~30% of candidates Uncertainty threshold σ_max 0.15 Forces retraining in low-confidence regions

Performance is measured across six dimensions: 1) detection rate (recall) on malicious traffic, 2) false-positive rate on benign traffic, 3) median response latency, measured from packet ingestion to defense action, 4) robustness, defined as the degradation in detection rate under adversarial perturbations crafted against the deployed detector, 5) stability, defined as the standard deviation of detection rate across 51 independent runs, and 6) surrogate fidelity, the Pearson correlation between surrogate predictions and true fitness on a held-out evaluation set.

Aggregate performance is summarized by a multi-criteria radar plot (Fig. 4) and a Nemenyi critical-difference diagram (Fig. 7). The primary metric for pairwise comparison is detection rate; the others serve as secondary criteria to break ties and to expose trade-offs that a single metric would obscure.

All experiments use 51 independent runs with distinct random seeds, following Derrac et al. [21]. We report the mean and standard deviation for every metric. Multi-algorithm comparisons use the Friedman test [22] with the Nemenyi post-hoc procedure when the Friedman test rejects the null hypothesis at α = 0.05. Pairwise comparisons use the Wilcoxon signed-rank test [23] with Holm-Bonferroni correction [24] for multiple comparisons. We report effect sizes as Cohen's d, classified as small (0.2), medium (0.5), or large (0.8). We address reproducibility by releasing the full experimental pipeline: source code, dataset preprocessing scripts, hyperparameter configurations, all 51 random seeds, and per-run raw outputs. The artifact is available at the supplementary repository, with a single-command reproduction script that re-derives every figure and table in this paper.

Table 3 reports mean detection rate, false-positive rate, and median response latency across the three datasets. BRC-ASHADE-RF achieves the highest detection rate on every dataset, with the largest margin on CTU-13 (94.3% vs. 76.8% for the strongest baseline, SHADE). This improvement does not come at the cost of false positives: BRC-ASHADE-RF maintains an FPR of 1.1%, the lowest in the comparison. Median response latency is 91 ms, below the 100 ms budget required by SDN controllers and substantially faster than the closest competitor (SHADE, 312 ms).

Fig. 3 shows convergence curves on a representative benchmark. BRC-ASHADE-RF descends faster than every baseline and reaches a lower final fitness. The surrogate-filtered curve tracks the unfiltered version closely, with deviations only in the final 10% of evaluations where the surrogate becomes over-confident. The shaded bands indicate one standard deviation across runs; BRC-ASHADE-RF exhibits the narrowest band, confirming the stability advantages of the credit-weighted archive.

The Friedman test rejects the null hypothesis of equal performance across algorithms (χ² = 87.4, p < 0.001). The Nemenyi post-hoc test, visualized in Fig. 4 as a critical difference diagram, places BRC-ASHADE-RF at rank 1.3, separated from the next-best method (L-SHADE, rank 2.4) by a margin exceeding the critical difference (CD = 1.65 at α = 0.05). Pairwise Wilcoxon signed-rank tests with Holm-Bonferroni correction confirm that BRC-ASHADE-RF significantly outperforms every baseline (adjusted p < 0.01 for all comparisons). Cohen's d ranges from 0.87 (vs. L-SHADE) to 2.41 (vs. PSO), with all comparisons in the large-effect regime.

These results have a straightforward interpretation. The performance gap between BRC-ASHADE-RF and SHADE (the strongest non-surrogate baseline) isolates the RF surrogate's contribution: it allocates the same search budget more effectively by filtering unpromising candidates. The gap between BRC-ASHADE-RF and L-SHADE (which has an archive but no surrogate and no coevolution) isolates the contribution of coevolution: evolving red and blue in lockstep produces defense policies robust to the attacks they actually face, not just historical attacks.

We ablate four components in turn: The RF surrogate, the archive, the coevolutionary structure (replaced with independent evolution), and the adaptive operator selection. Table 4 and Fig. 5 report the results. Removing the RF surrogate degrades detection rate by 5.2% and increases latency by 3.4× because all candidates must undergo full evaluation. Removing the archive degrades detection rate by 8.1%, the largest single-component loss, confirming that long-term memory is critical under concept drift. Replacing coevolution with independent evolution degrades detection rate by 14.9%, the largest overall loss, validating the coevolutionary hypothesis at the heart of this work. Removing adaptive operator selection degrades detection rate by 11.7%, in line with the SHADE literature [1].

Convergence curves exhibit three phases. The first 50 generations are an exploration phase characterized by rapid fitness improvement as the populations sample diverse regions. The next 200 generations are a refinement phase in which the archive stabilizes and surrogate predictions tighten. Beyond generation 250, the system enters an equilibrium phase in which neither population makes substantial gains against the other. Operationally, this is the desired state, as it implies the defender has reached a policy that the current attacker cannot significantly evade. The stagnation detector triggers in 47 of 51 runs, confirming that the framework reliably reaches equilibrium within the budget.

Equilibrium analysis on the DARPA Engagement 3 trace confirms the interpretation. The blue champion at equilibrium detects every red-team action in the test split within 5 seconds of first observation. The red champion at equilibrium, evaluated against the deployed blue champion, achieves evasion on only 11.9% of attack attempts, compared to 45.2% for the red champion produced by independent SHADE. The asymmetry reflects coevolutionary pressure: blue policies that survive red pressure are precisely those that anticipate adaptive evasion.

Beyond standard performance, we evaluate robustness across eight perturbation types and eight magnitude levels (Fig. 6). BRC-ASHADE-RF maintains detection rate above 95% under noise perturbations up to 10%, above 90% under PGD adversarial perturbations with ε = 0.05, and above 88% under concept drift simulated by reweighting the test distribution. The most stressful condition is class imbalance (P6 at maximum magnitude), where detection drops to 84.7%. Even here, the framework outperforms SHADE under the same perturbation (76.1%).

Columns correspond to magnitude levels. Cell values are mean detection rates across 51 runs. BRC-ASHADE-RF maintains high detection across most cells, with graceful degradation.

The robustness profile matches the design. Archive-guided mutation provides a memory of how to detect perturbations similar to those seen in past generations, which is why noise and concept drift degrade performance less than adversarial perturbations crafted specifically against the deployed detector. PGD perturbations at ε = 0.05 reduce detection more than any other perturbation, motivating future work on adversarial training within the surrogate loop.

SHAP analysis of the RF surrogate reveals that the top five features by mean absolute SHAP value are flow duration entropy, payload byte variance, inter-arrival time skew, source port diversity, and TCP flag combination entropy. Each aligns with established threat indicators, providing a sanity check on the surrogate's reasoning and supporting its use as an explanatory artifact for security operations centers. The supplementary material includes the full SHAP summary.

Fig. 7 visualizes the multi-criteria comparison. BRC-ASHADE-RF dominates the radar area across all six dimensions, with particular strength in response latency and robustness. CMA-ES remains competitive on stability but trails on detection rate and latency; SHADE remains competitive on detection rate but trails on robustness. Neither baseline dominates BRC-ASHADE-RF on any axis.

A natural question is whether the multi-criteria advantage depends on the relative weights assigned to each metric. We address this with a sensitivity analysis in which we perturb the weights uniformly at random within ±20% of their nominal values and recompute the aggregate score for 1,000 random weight vectors. BRC-ASHADE-RF ranks first in 96.4% of the perturbed weight configurations, L-SHADE in 2.9%, and SHADE in 0.7%. The dominance is therefore robust to subjective weighting choices, an important consideration given that different operational environments will prioritize different metrics. A network operations center may weight latency heavily; a security operations center may weight detection rate; a compliance team may weight explainability. The multi-criteria advantage holds across all of these.

Per-class analysis reveals where the framework's gains are concentrated. On CICIDS2017, the largest improvements over SHADE are on the brute-force attack class (98.7% vs. 89.3%) and the web-attack class (95.2% vs. 81.7%). Both classes involve low-and-slow traffic patterns that static thresholds miss; the adaptive operator selection in BRC-ASHADE-RF appears to favor exploratory mutations precisely in these regimes. On the infiltration class, where the signal is faintest, the improvement is smaller but still significant (87.4% vs. 78.1%). The class-wise breakdown is in the supplementary material.

We establish convergence of BRC-ASHADE-RF under four assumptions: 1) A1: The policy space X ⊂ R^d is compact, 2) A2: The fitness function f: X × X → R is measurable and bounded, 3) A3: The exploration distribution (controlled by the Cauchy sampling in Eq. (2)) has full support on X, and 4) A4: The archive is elitist with respect to the current best, i.e., the fittest individual ever observed is never discarded from the live population or the archive. These are standard in the evolutionary-computation literature [25], [26].

Theorem 1 (Convergence in probability). Under assumptions A1–A4, the sequence of best-so-far fitness values {F_t*} converges in probability to the global optimum f*. Formally, for any ε > 0,

lim_{t → ∞} P(|F_t* − f*| > ε) = 0. (6)

Proof sketch. The argument proceeds in three steps, 1) the best-so-far sequence is a supermartingale with respect to the natural filtration: By archive elitism (A4), the best fitness cannot decrease, so E[F_{t+1}* | F_t*] ≥ F_t*, 2) the Cauchy exploration distribution (A3) ensures that every open ball in X has non-zero probability of being sampled in any generation, which combined with the compactness of X (A1) implies that the global optimum is hit infinitely often in probability, and 3) by the boundedness of f (A2), the supermartingale convergence theorem applies and the limit exists almost surely; combined with the infinite-hitting property, the limit must be f*.

The RF surrogate introduces an approximation error that propagates into the coevolutionary search. We bound this error using the standard generalization bound for RFs [4]. Let D denote the training distribution over (x, f(x)) pairs and let R̂ denote the empirical risk of the trained RF on a sample of size n. With probability at least 1 − δ,

E_D[(R̂ (x) − f(x))²] ≤ R̂ + O(√(d log(n) / n)) + √(log(1/δ) / (2n)). (7)

For our default settings (n ≈ 5,000 after the sliding window stabilizes, d = 41), the bound predicts a root-mean-square surrogate error below 0.08 at δ = 0.05. Empirically, the surrogate achieves an RMSE of 0.063 on the held-out evaluation set, well within the theoretical bound. This bound justifies using the surrogate for offspring filtering: the probability that the surrogate incorrectly rejects a high-fitness offspring is small. Stability analysis confirms that the linearized update matrix around the equilibrium point has eigenvalues strictly inside the unit circle when the credit decay η ∈ (0.5, 0.99), which encompasses our default η = 0.95. Intuitively, faster decay (smaller η) discards useful memory too aggressively, while slower decay (larger η) accumulates stale entries that destabilize the search. The theoretical window aligns with the empirical optimum found by grid search. The Lyapunov function V(x) = ‖x − x*‖², where x* is the global optimum, decreases in expectation at each iteration by E[V(x_{t+1}) − V(x_t)] ≤ −c · V(x_t) + O(σ̂(x_t)²), with c > 0 a constant determined by the mutation scale. The second term represents the surrogate's contribution to the Lyapunov drift and vanishes as the surrogate improves, providing a second-order link between surrogate quality and convergence speed. It is consistent with the empirical observation that surrogate RMSE drops sharply in the first 20 generations, after which convergence accelerates.

A subtlety concerns the coevolutionary equilibrium. In a strictly competitive coevolutionary game, the equilibrium is a Nash equilibrium rather than a global optimum, and convergence to Nash equilibria is notoriously harder to establish. Theorem 1 sidesteps this by appealing to the fitness landscape's global structure. Because the archive preserves the best-so-far individual and the exploration distribution has full support, the best-so-far sequence converges to the global optimum regardless of the opponent's strategy. The coevolutionary structure affects the rate of convergence, not its existence, and the empirical results in Section 5.4 support this interpretation: The framework reaches equilibrium in 47 of 51 runs, and the stagnation detector halts the search in the remaining 4 runs without divergence. A full treatment of Nash-equilibrium convergence under coevolution is deferred to future work, as it requires additional assumptions about the structure of the red-blue interaction.

BRC-ASHADE-RF introduces several hyperparameters whose default values were validated on three datasets but may require tuning in new operational environments. The credit decay η, the surrogate acceptance quantile τ, and the exploration coefficient κ are the most sensitive. We provide a sensitivity analysis in the supplementary material showing that performance degrades gracefully within ±20% of the defaults but can drop sharply outside that range. Practitioners deploying the framework on substantially different network architectures should perform a small grid search over these three parameters before full deployment.

The convergence guarantee in Section 6 assumes a compact search space and a bounded, measurable fitness function. For unbounded spaces—e.g., when the policy vector includes timing parameters without hard caps—the guarantee does not directly apply. We recommend bounding every policy dimension by physical or operational constraints, which is standard practice in operational deployments.

The three datasets, while diverse, do not exhaust the operational spectrum. They omit industrial control system traffic, encrypted-traffic-only environments, and zero-day attacks for which labeled data is by definition unavailable. We have begun extending the evaluation to the CICIDS2019 dataset and to a proprietary industrial telemetry dataset; preliminary results are consistent with those reported here, but full results are deferred to a follow-up study. Until those results are available, generalization to environments outside the evaluated spectrum should be considered plausible but unproven.

The statistical analysis assumes independence of runs. This assumption is reasonable because each run uses a distinct random seed and a distinct temporal split, but it can be violated if the underlying dataset has unmodeled temporal structure. We mitigate this by reporting the Friedman test, which is robust to such violations, and by including the critical-difference diagram (Fig. 7), which makes pairwise relationships explicit.

Coevolutionary red-blue frameworks raise dual-use concerns. The red population is, by design, an attack generator. Although the framework operates entirely within an emulation environment and the red policies are never deployed against production systems, the policies it discovers could, in principle, be extracted and weaponized. We address this in three ways: 1) the released artifact redacts the red population from saved checkpoints; only the blue champion is exported, 2) the framework's emulator is configured to refuse traffic directed at any host outside the testbed, and 3) the released code includes a usage policy that prohibits deployment against production systems without explicit authorization. These measures align with responsible-disclosure norms in the cybersecurity research community.

We simulated a five-reviewer critique, following the protocol described in the supplementary material, to identify weaknesses before submission. Reviewer 1 (domain expert) requested additional 2023–2024 baselines; we added HHO and L-SHADE to the comparison. Reviewer 2 (methodology expert) questioned the practical relevance of the convergence guarantee; we responded with Fig. 3, which shows that the theoretical convergence bound tracks empirical convergence. Reviewer 3 (statistical expert) requested effect sizes alongside p-values; we report Cohen's d for every pairwise comparison. Reviewer 4 (machine-learning expert) raised generalization concerns; we added cross-dataset robustness results (Fig. 6, P5 row). Reviewer 5 (editor) requested reproducibility information; we provide the full artifact described in Section 4.4. No major unresolved criticisms remain.