KTH researcher in graph-based cyber operations simulation and cyber-range evaluation of autonomous RL defense agents
2
papers here
2
reviewed by Evolve
2
first-author
0
corresponding
—
works · OpenAlex
—
h-index · OpenAlex
Bibliometric figures come from OpenAlex (2026-10-15) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.
Research profile
Output—
Not yet scored: this snapshot contains no aggregate publication counts or venue history beyond the two 2026 arXiv preprints, so output volume cannot be computed. This axis would measure total indexed publications and first-author share over time.
Impact—
Not yet scored: no citation counts, h-index or venue-level influence data exist in this snapshot, so impact cannot be estimated. This axis would measure citations to the two 2026 preprints and uptake of the MAL Simulator and cyber-range findings.
Focus0/100
Focus scores 0 because the field distribution is split exactly 50/50 between two labeled fields — computer security (AI-driven cyber operations simulation) and cybersecurity (autonomous cyber defense). In practice the two halves are adjacent: both cataloged papers attack the same problem, autonomous cyber defense, from simulation and live-range angles respectively. The zero therefore reflects an even two-way split in the metadata rather than genuinely scattered research interests.
Collaboration39/100
The collaboration axis scores 39, computed from a small footprint of 6 distinct coauthors across the cataloged work. The recurring group — Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt, Sandor Berglund and Teodor Sommestad — suggests a stable, tightly knit circle. Both 2026 papers list him as first author, indicating he leads the writing within this compact network rather than spreading across many partnerships.
Activity—
Not yet scored: the snapshot provides no year-by-year publication record, so recent publishing rate cannot be computed. This axis would measure publication cadence and recency of indexed output, currently observable only through the two 2026 arXiv postings.
Reproducibility55/100
Reproducibility scores 55, the mean across 2 papers carrying Evolve reproducibility assessments, each rated medium readiness. The MAL Simulator's case-study reinforcement-learning results are judged credible but validated only in simulation; the 37-VM cyber-range study is a credible sim-to-real comparison, though statistics are thin and NoOp wins under the Guided attacker. Simulation-only validation and thin statistics are the main flagged reproduction risks.
Research summary
Jakob Nyberg is a researcher at KTH Royal Institute of Technology working at the intersection of cyber operations modeling and autonomous cyber defense. The current catalog shows him as first author on two 2026 arXiv papers. The first, The MAL Simulator, turns the Meta Attack Language into a simulation engine driven by attack and defense graphs, adding language-driven adaptability and dual attacker/defender interfaces, with an early reinforcement-learning case study that Evolve judges credible but validated only in simulation. The second moves from simulation toward real infrastructure: a 37-VM cyber range evaluation of autonomous network incident-response agents in which reinforcement-learning agents outperform a heuristic baseline, though Evolve notes thin statistics and that a NoOp policy wins under the Guided attacker. Together the two papers trace a deliberate sim-to-real pipeline, from formal graph models to live-range testing. His recorded collaboration footprint is compact — six distinct coauthors, including Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt, Sandor Berglund and Teodor Sommestad — and both papers carry medium reproducibility readiness, with a mean reproducibility score of 55 across the two. Output, impact and activity axes remain unscored pending more indexed data.
Collaboration pattern
The cataloged work shows a compact, stable collaboration pattern: 6 distinct coauthors across the two 2026 first-author papers, with a recurring group of Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt, Sandor Berglund and Teodor Sommestad. The 39 collaboration score reflects this small, concentrated circle rather than wide cross-institution networking; both papers are led by Nyberg as first author.
Research keywords
Highlights
The MAL Simulator: attack and defense graphs meet a modeling language
RL incident-response agents tested in a 37-VM cyber range
A first-author pipeline from formal models to live-range testing
Both 2026 catalog entries are first-authored and share a reinforcement-learning core, forming a coherent sim-to-real thread — graph-based simulation first, cyber-range validation next — with both papers rated medium for reproducibility readiness.
Timeline
- 2026Posts The MAL Simulator on arXiv as first author, introducing graph-based cyber operations simulation built on the Meta Attack Language.
- 2026Publishes the cyber-range evaluation of autonomous network incident response agents, testing reinforcement-learning agents against a heuristic baseline across 37 VMs.
- 2026Records 6 distinct coauthors across the two papers, working with a recurring group including Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Mathias Ekstedt, Sandor Berglund and Teodor Sommestad.
Papers in the Evolve catalog
Frequent co-authors
About this profile
This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.
- Dimension scores are computed from a small bibliometric snapshot (2 cataloged papers, 6 distinct coauthors) and may change as more indexed output is added.
- Output, impact and activity axes are unscored because citation counts, publication totals and per-year output are absent from the current data.
- Both cataloged papers are 2026 arXiv preprints; no peer-reviewed venue records are included in this snapshot.
- This profile is name-resolved from public bibliographic data tied to ORCID 0000-0003-2663-0708; Jakob Nyberg is a relatively common Swedish name, so identity confidence depends on that linkage.