Environment · arXiv:2604.09523

NetForge

A gym where you train agents that attack a network — and agents that defend it.

You write a trainer. NetForge is the world it plays in: a generated enterprise / OT network, a red operator, three zone-split blue agents, and a filtered SIEM feed instead of a ground-truth state vector. PettingZoo API. Same seed, same episode. MITRE tags, not exploit code.

How to use it Paper GitHub

NetForge penguin — lifting the network graph

How the system fits together

Your trainer only sees observations, rewards, and action masks. Red has to recon. Blue reads SIEM, not the true graph.

How to use it

1

Install

Python package from GitHub. The [jax] extra pulls the vectorized backend.

pip install 'netforge_rl[jax] @ git+https://github.com/reforcemind/NetForge_RL'

2

Make an environment

Pick a difficulty and a scenario. easy / medium / hard, plus a frozen held-out split for eval.

from netforge_rl.environment import make_env

env = make_env("medium", scenario_type="ransomware", seed=0)
obs, infos = env.reset(seed=0)

3

Step it like any PettingZoo env

Four agents: red_operator, blue_dmz, blue_internal, blue_restricted. Actions take time — an isolate cancels an in-flight exploit on that host.

while env.agents:
    actions = {a: env.action_space(a).sample() for a in env.agents}
    obs, rewards, term, trunc, infos = env.step(actions)
    if all(term.values()) or all(trunc.values()):
        break

4

Train, then probe

Use the JIT IPPO baseline, or plug in JaxMARL / RLlib / CleanRL / SB3 via the gym facade. Score policies with the six diagnostic probes (memory, attention, temporal, precision, safety, generalization) — not only mean reward.

Scenarios you can pick

ransomware

Red tries to lock Corporate + Secure. Blue contains and restores.

apt_espionage

Red persists and exfiltrates. Blue isolates every foothold.

cloud_hybrid

Red breaches the Secure enclave. Blue keeps the Secure SLA.

iot_grid

Red takes the controllers. Blue keeps controllers healthy.

ot_stuxnet

Red drives a PLC kinetic. Blue stops physical damage.

Scenario	Red tries to	Blue tries to
ransomware	lock Corporate + Secure	contain and restore
apt_espionage	persist and exfiltrate	isolate every foothold
cloud_hybrid	breach the Secure enclave	keep the Secure SLA
iot_grid	take the controllers	keep controllers healthy
ot_stuxnet	drive a PLC kinetic	stop physical damage