From Sci-Fi to SOC: How CSLE is Training AI to Predict Cyber Attacks Like a Junior Analyst

Introduction:

The concept of predictive security, reminiscent of “Minority Report,” has long been a cybersecurity dream. While we are far from precrime units for cyber threats, a new paradigm is emerging where Artificial Intelligence (AI) can be trained to anticipate and defend against attacks not through theoretical models, but through practical, hands-on experience in simulated environments. Tools like the Cybersecurity Learning Environment (CSLE) are turning this concept into a reality by immersing AI agents in the chaotic, unpredictable reality of a live network, allowing them to learn from simulated incidents just as a human Security Operations Center (SOC) analyst would.

Learning Objectives:

• Understand the role and architecture of the CSLE cyber range for AI training.
• Learn how to deploy a basic CSLE topology and integrate a Reinforcement Learning (RL) agent.
• Explore methods for simulating attacks and measuring AI-driven defensive responses.

You Should Know:

1. Demystifying CSLE: The AI Cyber Range

CSLE is an open-source platform designed not for human training, but specifically for educating AI agents through Reinforcement Learning (RL). In RL, an agent learns to make decisions by performing actions in an environment and receiving rewards or penalties. CSLE provides that environment—a full, complex network simulation where the AI can practice defense, intrusion, response, and control. It uses Linux containers (LXC) to emulate real machines, networks, and services, creating a sandboxed but highly realistic playground for AI.

Step-by-Step Guide: Initial CSLE Setup

Step 1: Prerequisites. Ensure you have a Linux system (Ubuntu 20.04+ is recommended) with Docker and Python 3.8+ installed.

Step 2: Clone the Repository.

git clone https://github.com/Limmen/csle
cd csle

Step 3: Build the Base Images. This step creates the Docker images that will serve as the “machines” in your cyber range.

 From the project root, run the build script
sudo python3 -m csle csle-base

Step 4: Verify Installation. Check that the core CSLE services are running correctly using the command-line interface.

csle --help

2. Building Your First Cyber Range Topology

A topology defines the structure of your simulated network: its subnets, hosts, routers, and services. CSLE uses configuration files to define these elements, which can be managed via its CLI, API, or web interface.

Step-by-Step Guide: Creating a Simple Client-Server Topology

Step 1: Define the Emulation. Create a JSON or YAML configuration file (e.g., my_topology.json) describing a network with two subnets: one for a client and one for a server.

{
"name": "basic-client-server",
"network": {
"subnets": [
{
"name": "client-subnet",
"ip": "10.10.1.0/24",
"hosts": [
{
"name": "client-host",
"image": "csle-base",
"services": ["ssh"]
}
]
},
{
"name": "server-subnet",
"ip": "10.10.2.0/24",
"hosts": [
{
"name": "web-server",
"image": "csle-base",
"services": ["ssh", "http"]
}
]
}
]
}
}

Step 2: Start the Emulation. Use the CSLE CLI to launch your defined topology.

csle emulation create -c my_topology.json

Step 3: Access the Environment. You can now SSH into the containers to interact with them directly, simulating a real network.

 Find the container ID for the web-server
docker ps --filter "name=web-server"
 Access it
docker exec -it <container_id> /bin/bash

3. Injecting Simulated Attacks for AI Training

A static network teaches an AI nothing. The core of CSLE is its ability to simulate attacker behavior, creating a dynamic environment where the AI must respond. This is done through “emulation traces”—scripts that define sequences of attacker actions, such as port scans, brute-force attacks, or vulnerability exploitation.

Step-by-Step Guide: Simulating a DDoS Attack

Step 1: Create an Attack Script. Write a Python script (ddos_attack.py) that uses a tool like `hping3` from within one of the client containers to simulate a DDoS attack on the web server.

!/usr/bin/env python3
import subprocess
 This script would be executed by the CSLE attacker component on the client-host
target_ip = "10.10.2.10"  IP of the web-server
 Launch a flood of SYN packets
subprocess.run(["hping3", "--flood", "--syn", "-p", "80", target_ip])

Step 2: Integrate the Attack into a Trace. Define this script as part of an emulation trace in your CSLE configuration, specifying when it should be triggered during the simulation.
Step 3: Observe the Impact. The AI agent monitoring the network will now see a massive spike in traffic, forcing it to decide on a response: block the source IP, rate-limit traffic, or perhaps take no action (and be penalized).

4. Integrating and Training a Reinforcement Learning Agent

The AI agent is the “brain” that interacts with the CSLE environment. It observes the state of the network (e.g., logs, traffic flows, system metrics), takes actions (e.g., block an IP, kill a process), and receives rewards based on the outcome.

Step-by-Step Guide: A Simple Python RL Agent Skeleton

Step 1: Install RL Libraries. Popular choices include `stable-baselines3` or ray

</code>.
[bash]
pip install stable-baselines3 gym

import gym
from stable_baselines3 import PPO

class CSLEEnv(gym.Env):
def <strong>init</strong>(self):
super(CSLEEnv, self).<strong>init</strong>()
 Define action and observation space
self.action_space = gym.spaces.Discrete(3)  e.g., 0=do nothing, 1=block IP, 2=alert
self.observation_space = ...  Define based on network metrics

def step(self, action):
 Execute 'action' in CSLE via its API
 Observe new state, reward, and if the episode is done
return observation, reward, done, info

def reset(self):
 Reset the CSLE emulation to a clean state
return observation

Initialize and train the agent
env = CSLEEnv()
model = PPO("MlpPolicy", env, verbose=1)
model.learn(total_timesteps=10000)

csle web start