KTH researcher building attack-graph simulation and cyber-range testbeds for autonomous, RL-driven cyber defence
2
papers here
2
reviewed by Evolve
0
first-author
0
corresponding
—
works · OpenAlex
—
h-index · OpenAlex
Bibliometric figures come from OpenAlex (2026-10-15) and cover the author's entire public record, not just the papers listed here. Reproducibility signal comes from Evolve's own reviews.
Research profile
Output—
No publication-count or venue data is available in this snapshot, so the output axis is not scored. It would measure the volume, recency, and venue quality of the researcher's published articles and preprints.
Impact—
Citation-based impact metrics are not present in the input data, so the impact axis is left unscored. This axis would measure how often and how widely the researcher's work is cited and taken up by the field.
Focus0/100
The focus score is 0 because the observed output splits exactly evenly (0.5/0.5) between two labeled fields, 'computer security (AI-driven cyber operations simulation)' and 'cybersecurity (autonomous cyber defense)'. In practice the two are adjacent: both catalog papers apply attack simulation and reinforcement learning toward autonomous defense, so the low score reflects an even two-way split within one coherent cybersecurity agenda rather than scattered work.
Collaboration39/100
The collaboration score is 39, computed from 6 distinct coauthors in the raw bibliometric data. On both catalog papers Pontus Johnson appears as a middle author and is not the corresponding author, consistent with team-based work. Recurring collaborators include Jakob Nyberg, Andrei Buhaiu, Joakim Loxdal, Mathias Ekstedt, Sandor Berglund, and Teodor Sommestad — a compact, KTH-centered authorship cluster.
Activity—
No time-series publication data is available, so the activity axis is not scored. It would measure publishing cadence and recent output intensity, such as papers per year and the gap since the latest item.
Reproducibility55/100
Reproducibility scores 55, a mean taken over the 2 papers Evolve has reviewed; both are rated medium reproducibility readiness. Both are arXiv preprints describing simulation and 37-VM cyber-range experiments; Evolve's verdicts flag validation confined to simulation and thin statistics, which temper but do not negate reuse potential.
Research summary
Pontus Johnson is a researcher at KTH Royal Institute of Technology whose profile, anchored to ORCID 0000-0002-3293-1681, is built from a bibliometric snapshot plus two papers reviewed in the Evolve catalog. Both are 2026 arXiv preprints in which he appears as a middle author and not the corresponding author. The first, The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs, extends the Meta Attack Language ecosystem with a simulator exposing dual attack- and defense-side interfaces; Evolve judges its case-study reinforcement-learning results credible but validated only in simulation. The second, A Cyber Range Evaluation of Autonomous Network Incident Response Agents, reports reinforcement-learning agents beating a heuristic baseline in a 37-VM cyber range, a study Evolve deems a credible sim-to-real transfer evaluation while flagging thin statistics and a NoOp policy that wins under a Guided attacker. His radar is coherent despite a focus score of 0: observed output splits exactly 0.5/0.5 between AI-driven cyber operations simulation and autonomous cyber defense, two adjacent subfields of one agenda. Collaboration scores 39 on 6 distinct coauthors; reproducibility scores 55 as the mean over two medium-readiness papers. Output, impact, and activity axes lack sufficient data and remain deliberately unscored.
Collaboration pattern
Pontus Johnson works in a compact, KTH-centered team: the bibliometric snapshot lists 6 distinct coauthors (collaboration score 39), and both catalog papers position him as a middle author rather than corresponding author. Frequent collaborators include Jakob Nyberg, Andrei Buhaiu, Joakim Loxdal, Mathias Ekstedt, Sandor Berglund, and Teodor Sommestad, suggesting sustained group authorship around attack simulation and autonomous cyber-defense experimentation rather than wide external networking.
Research keywords
Highlights
MAL Simulator: dual attack/defense simulation on the Meta Attack Language stack
Taking incident-response agents from simulation to a 37-VM cyber range
Timeline
- 2026Posts 'The MAL Simulator: Cyber Operations Simulation based on Attack & Defense Graphs' to arXiv, extending the Meta Attack Language ecosystem with dual attack/defense simulation interfaces.
- 2026Posts 'A Cyber Range Evaluation of Autonomous Network Incident Response Agents' to arXiv, reporting reinforcement-learning agents beating a heuristic baseline in a 37-VM cyber range.
- 2026Both papers enter the Evolve catalog with medium reproducibility-readiness ratings, together underpinning his radar's reproducibility score of 55.
Papers in the Evolve catalog
Frequent co-authors
About this profile
This profile is AI-structured by Evolve.Pub from public bibliographic data (OpenAlex) and Evolve's own paper reviews. It is not written or endorsed by the researcher unless the profile is claimed. Radar dimensions are computed from real bibliometrics with fixed formulas — raw figures are shown alongside; missing dimensions mean insufficient data, never zero. Errors? Claim the profile to correct or hide it.
- Bibliometric scores and raw counts derive from OpenAlex-based bibliometric data only; no citation counts, h-index, or publication totals are available in this snapshot.
- Only two papers (both 2026 arXiv preprints) are covered by the Evolve catalog; this profile reflects that narrow slice, not a full career record.
- Output, impact, and activity radar axes lack sufficient underlying data and are deliberately left unscored rather than estimated.
- Identity is name-resolved from public bibliographic data anchored to ORCID 0000-0002-3293-1681; no independent biographical verification was performed.