Cyber Agents for Security Testing and Learning Environments (CASTLE)

Background
The CASTLE program seeks to develop an AI-toolkit to instantiate realistic network environments and train cyber agents to enable resilient network operations against advanced persistent threats (APT). The program aims to integrate R&D efforts into a useful open source toolkit for hardening bespoke networks. The program will collaborate with potential transition partners early and continuously throughout the program to ensure that CASTLE capabilities support transition partner needs. The program will conduct operational evaluations once a year to measure performer metrics with an emulated advanced persistent threat.

Work Details
The SOW includes detailed tasks for the Purple Team, Blue Team, and Red Team. The Purple Team is responsible for simulating/executing actual environments, enabling agents to simulate/execute operationally relevant workflows, and customizing to Mission Partner Platform. The Blue Team focuses on maintaining operationally relevant workflows, defending operationally relevant workflows, and customizing to Mission Partner Platform. The Red Team is tasked with demonstrating possible attack paths in operationally relevant workflows, reaching critical assets with widely available tools used by APTs, and incorporating curated datasets as feedback to agent simulations.

Period of Performance
The schedule includes three phases: Baseline Environments, Transition Relevant Environments, and Operational Tailoring. Each phase has specific performance metrics and deliverables outlined in Table 1 of the solicitation.