Kim-Hammar/csle

Kim-Hammar/csle has 161 GitHub stars and 29 forks. Star changes are not measured yet. Last checked 2026-11-11 01:13 UTC. Last push 2026-09-14.

How these counts are measured

A research platform to develop automated security policies using quantitative methods, e.g., optimal control, computational game theory, reinforcement learning, optimization, evolutionary methods, and causal inference.

161 stars 29 forks

Measured star growth

in 24h: Update delayed
in 7 days: Collecting history
in 15 days: Collecting history
in 1 month: Collecting history

Net star changes over overlapping periods, not daily totals. Missing measurements are left blank. Stars measure attention, not software quality.

README.md

Original

The Cyber Security Learning Environment (CSLE)

CSLE is a platform for evaluating and developing reinforcement learning agents for control problems in cybersecurity. It can be considered as a cyber range specifically designed for reinforcement learning agents. Everything from network emulation, to simulation and implementation of network commands have been co-designed to provide an environment where it is possible to train and evaluate reinforcement learning agents on practical problems in cybersecurity. The platform can also be used to combine reinforcement learning with other quantitative methods, e.g., dynamic programming, computational game theory, evolutionary methods, causal inference, and general optimization.

Citation

To cite this software package, please use the following BibTeX entry:

@inproceedings{csle_docs,
 author = {Hammar, Kim},
 booktitle = {Proceedings of Machine Learning and Systems},
 editor = {A. Chowdhery and Z. Jia},
 pages = {716--730},
 publisher = {MLSys},
 title = {{CSLE}: A Reinforcement Learning Platform for Autonomous Security Management},
 url = {https://proceedings.mlsys.org/paper_files/paper/2026/file/87eaaa8605a1a472d9a9756e7500517b-Paper-Conference.pdf},
 volume = {8},
 year = {2026}
}

Main Features

🖥️ Emulation System

CSLE includes a system for emulating large scale IT infrastructures, cyber attacks, and client populations. It is based on Linux containers and can be used to collect traces and to evaluate security policies.

Note The emulation system is mainly designed to run on a distributed system, e.g., a compute cluster. It can run on a laptop as well, but then only small emulations can be created.

💭 Simulation System

CSLE includes a simulation system for executing reinforcement learning algorithms and simulating Markov decision processes and Markov games. It is built in Python and can be integrated with standard machine learning libraries.

Note The simulations are compatible with OpenAI Gym/Gymnasium. Hence you can integrate the simulations with your own implementations of reinforcement learning algorithms.

⚙️ Management System

CSLE includes a system for managing emulations and simulations which can be accessed either through Command-Line Interface (CLI), through a REST API, through Python libraries, or through a web interface. The management system allows a) to start/stop emulations/simulations; b) real-time monitoring of emulation and simulation processes; and c), shell access to components of emulations.

🎓 Documentation

Documentation, installation instructions, and usage examples are available here. A PDF version of the documentation is available here. A video walkthrough of the installation process is available here.

📋 Supported Releases

Release	Last date of support
v.0.10.0	2027-01-01
v.0.9.0	2026-04-23
v.0.8.0	2025-08-09
v.0.7.0	2025-03-01
v.0.6.0	2024-12-24
v.0.5.0	2024-06-02
v.0.4.0	2024-02-07
v.0.3.0	2024-01-17
v.0.2.0	2023-10-30
v.0.1.0	2023-06-06

Maintenance releases have a stable API and dependency tree, and receive bug fixes and critical improvements but not new features. We currently support each release for a window of 6 months.

📈 Build Status

Workflow	Status
csle-agents
csle-attacker
csle-collector
csle-cli
csle-common
csle-defender
csle-ryu
csle-base
csle-system-identification
gym-csle-stopping-game-build
gym-csle-intrusion-response-game-build
python-linter
csle-tolerance-build
gym-csle-apt-game-build
gym-csle-cyborg-build
csle-attack-profiler-build
management-system

Supported Platforms

Datasets

A dataset of 6400 intrusion traces can be found here.

Maintainer

_{Kim Hammar}
<[email protected]>

🧑‍🤝‍🧑 Contribute

Contributions are very welcome. Please use GitHub issues and pull requests. See the documentation for further instructions.

List of Contributors :star2:

Thanks go to these people!

_{Kim Hammar}	_{Rolf Stadler}	_{Pontus Johnson}	_{Antonio Frederico Nesti Lopes}	_{Jakob Stymne}
_{Arvid Lagerqvist}	_{Nils Forsgren}	_{Forough Shahab Samani}	_{Bength Roland Pappila}	_{Yu Hu}
_{Yan Wang}	_{Aws Jaber}	_arounderor