Can ToM predict cyberattack trajectories?
Machine Theory of Mind for Autonomous Cyber-Defence
December 6, 2024
https://arxiv.org/pdf/2412.04367This paper explores using a Machine Theory of Mind (MToM) model, specifically a Graph Neural Network (GNN) based ToMnet variant called GIGO-ToM, to predict the behavior of adversarial agents in a simulated cybersecurity environment. It focuses on predicting which high-value targets attackers will pursue and their likely attack paths through a network. A novel metric, Network Transport Distance (NTD), is introduced to evaluate these predictions by measuring the similarity between predicted and actual attack trajectories, considering network topology.
Key points for LLM-based multi-agent systems:
- Graph-based reasoning: GIGO-ToM uses GNNs for processing network data, offering a natural fit for representing relationships and dependencies in multi-agent scenarios, especially where the environment structure is crucial (like computer networks or social interactions). This is highly relevant to LLMs operating within structured environments.
- Predicting agent behavior: The core function is predicting the goals (targets) and actions (attack paths) of other agents, a critical capability for LLMs in multi-agent collaborative or competitive settings.
- Interpretable metric: The NTD metric offers an interpretable measure of prediction accuracy, crucial for evaluating and improving LLM performance and understanding their decision-making process. The weighting component of NTD allows focusing on specific aspects of the prediction.
- Potential for NTD as a loss function: Preliminary work suggests NTD could be used as a differentiable loss function for directly training models to predict agent behavior in structured environments, offering a new training paradigm for LLMs in multi-agent systems.
- Few-shot learning: GIGO-ToM exhibits promising few-shot learning capabilities, important for LLMs which are often computationally expensive to train on large datasets.