CHARLES: Continuous Homeostatic Adversarial Resilience through Learning and Epistemic Sifting

Abstract

The increasing use of artificial intelligence (AI) and reinforcement learning (RL) in cybersecurity introduces the possibility of autonomous cyber agents capable of observing an environment, learning from interaction, and selecting sequential actions with limited human intervention.This development creates a challenge for conventional defensive strategies, which frequently depend on relatively stable system configurations, predefined detection rules, and human-led response processes.Cyber deception and moving target defense (MTD) provide mechanisms for increasing uncertainty and changing the environment encountered by an attacker, while game theory and reinforcement learning provide mathematical and computational approaches for modelling adaptive attacker-defender interactions.This paper proposes CHARLES (Continuous Homeostatic Adversarial Resilience through Learning and Epistemic Sifting), a conceptual defensive architecture designed to continuously manage the information and environmental conditions available to an autonomous attacker.Rather than attempting only to detect an attack after malicious activity has occurred, CHARLES proposes a feedback-based approach consisting of epistemic sifting, adaptive state transformation, adversarial learning estimation, and adversarial utility management.The framework aims to investigate whether controlled environmental variability and strategically deployed deception can reduce the stability of an attacker's learned policy, increase uncertainty, and alter the expected utility of attack strategies.The paper develops a simple mathematical model for representing attacker utility, environmental uncertainty, and defensive transformation.A simulation-based methodology is proposed to compare static and adaptive defensive environments against learning-based attackers.The work does not claim that continuous transformation universally defeats autonomous attackers; instead, it establishes a testable framework for investigating the relationship between defensive environmental adaptation and autonomous attacker learning.