Mathias Ekstedt

Research profile

Research summary

Mathias Ekstedt is a researcher at KTH Royal Institute of Technology whose catalogued work centers on simulation and empirical evaluation of AI-driven cyber operations. The Evolve catalog holds two of his 2026 arXiv papers, on both of which he appears in the last author position (non-corresponding). The first, "The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs," builds simulation on the Meta Attack Language, exposing dual attack and defense interfaces and including case-study reinforcement-learning experiments that Evolve judges credible but validated only in simulation. The second, "A Cyber Range Evaluation of Autonomous Network Incident Response Agents," reports reinforcement-learning agents for network incident response evaluated on a 37-VM cyber range; Evolve reads it as a credible sim-to-real study while flagging thin statistics and a scenario in which a NoOp baseline prevails. His indexed field distribution splits evenly (0.5/0.5) between AI-driven cyber operations simulation and autonomous cyber defense — two labels describing one coherent research line. The collaboration footprint is compact: 6 distinct coauthors, with Jakob Nyberg, Andrei Buhaiu, Joakim Loxdal, Pontus Johnson, Sandor Berglund and Teodor Sommestad recurring. Reproducibility averages 55 across the two reviewed papers, both rated medium readiness. Output, impact and activity metrics are not yet scored.

Research keywords

Highlights

• MAL Simulator: graph-based cyber operations simulation with dual attack–defense interfaces

  The 2026 arXiv paper builds cyber operations simulation on the Meta Attack Language (MAL) and attack & defense graphs, adding language-driven adaptability and parallel attack and defense interfaces. Evolve's review finds the case-study reinforcement-learning results credible but validated only in simulation; reproducibility readiness is rated medium. Ekstedt appears as last author.

• Autonomous incident-response agents stress-tested on a 37-VM cyber range

  A second 2026 arXiv paper evaluates reinforcement-learning agents for autonomous network incident response on a 37-VM cyber range, reporting gains over a heuristic baseline. Evolve calls it a credible sim-to-real study while noting thin statistics and that a NoOp agent wins under the Guided attacker; reproducibility readiness is medium. Ekstedt appears as last author.

• One research line from MAL modeling to live-range evaluation

  Across both reviewed papers the same thread runs: formal attack–defense modeling feeding reinforcement-learning-based autonomous defense, evaluated first in simulation and then on a physical cyber range. The even 0.5/0.5 field split in the bibliometric record reflects this single line rather than two unrelated agendas.

Timeline

1. 2026"The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs" appears on arXiv — Ekstedt's earliest catalogued entry, in the last author position.
2. 2026"A Cyber Range Evaluation of Autonomous Network Incident Response Agents" appears on arXiv, again with Ekstedt in the last author position and no corresponding role.
3. 2026Both catalogued papers fall in 2026, the earliest and only year in the current indexed record, with 6 distinct coauthors appearing across them.

Papers in the Evolve catalog

• 2026-09-15

  The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs

• 2026-09-15

  A Cyber Range Evaluation of Autonomous Network Incident Response Agents

Frequent co-authors