This report - a major revision of its previous release - describes a reference architecture for intelligent software agents performing active, largely autonomous cyber-defense actions on military networks of computing and communicating devices. The report is produced by the North Atlantic Treaty Organization (NATO) Research Task Group (RTG) IST-152 "Intelligent Autonomous Agents for Cyber Defense and Resilience". In a conflict with a technically sophisticated adversary, NATO military tactical networks will operate in a heavily contested battlefield. Enemy software cyber agents - malware - will infiltrate friendly networks and attack friendly command, control, communications, computers, intelligence, surveillance, and reconnaissance and computerized weapon systems. To fight them, NATO needs artificial cyber hunters - intelligent, autonomous, mobile agents specialized in active cyber defense. With this in mind, in 2016, NATO initiated RTG IST-152. Its objective has been to help accelerate the development and transition to practice of such software agents by producing a reference architecture and technical roadmap. This report presents the concept and architecture of an Autonomous Intelligent Cyber-defense Agent (AICA). We describe the rationale of the AICA concept, explain the methodology and purpose that drive the definition of the AICA Reference Architecture, and review some of the main features and challenges of AICAs.

翻译：本报告是其先前版本的重大修订，描述了一种用于执行主动、高度自主网络防御行动的智能软件代理的参考架构，这些行动在军事计算与通信设备网络上进行。该报告由北约（NATO）研究任务组（RTG）IST-152“用于网络防御与韧性的智能自主代理”编制。在与技术精湛的对手发生冲突时，北约军事战术网络将在激烈对抗的战场环境中运行。敌方软件网络代理（即恶意软件）将渗透友好网络，攻击友军的指挥、控制、通信、计算机、情报、监视、侦察以及计算机化武器系统。为对抗这些威胁，北约需要人工网络猎手——即专门从事主动网络防御的智能、自主、移动代理。基于此，北约于2016年启动了RTG IST-152。其目标是通过制定参考架构和技术路线图，加速此类软件代理的开发并向实践转化。本报告阐述了自主智能网络防御代理（AICA）的概念与架构。我们介绍了AICA概念的基本原理，解释了定义AICA参考架构的方法与目的，并回顾了AICA的一些主要特征与挑战。