arca-agent 1.9.6

ARCA — Recursive GNN+RL Autonomous Cyber Agent with Local LLM reflection

ARCA — Autonomous Reinforcement Cyber Agent

Public Demo — RL-powered network attack simulation with real CVEs, local & Kaggle GPU execution.

Live Demo: https://arca.dpdns.org — sign in with Google, no waitlist.

ARCA trains reinforcement-learning agents to find attack paths through simulated networks. It uses real CVEs from a 79-entry database, supports both local CPU and Kaggle GPU backends, and exports results as PDF/JSON/SARIF/STIX reports. The agent learns by trial and error — exactly how a real attacker would — and shows the exact chain of exploits it would use.

---

Quick Start

pip install arca-agent
arca serve              # starts API at http://localhost:8000

Or run the full web app with the Next.js frontend:

git clone https://github.com/DipayanDasgupta/arca.git
cd arca/frontend && npm install && npm run dev  # frontend at :3000
cd arca && pip install -e ".[dev]" && arca serve  # backend at :8000

---

Features

Feature	Status
5 built-in network presets (micro → enterprise, 4–25 hosts)	Stable
Custom YAML network upload	Stable
PPO RL training with GNN policy (CleanRL)	Stable
Structured attack traces with real CVEs (79 in database)	Stable
Local CPU execution	Stable
Kaggle GPU offload (push/poll/retrieve)	Stable
Per-user Kaggle credential upload	Stable
Canonical SimulationResult schema (shared Local/Kaggle)	Stable
10-stage job state machine with timeout detection	Stable
PDF / JSON / SARIF 2.1 / STIX 2.1 report export	Stable
Interactive Plotly network topology + vulnerability heatmap	Stable
CVE database browser (search, filter by OS/severity)	Stable
Security audit with LLM reflection (Groq/Ollama)	Stable
Attack graph visualization (host→host chain with CVE table)	Stable
Cancel training button	Stable
Light/dark mode	Stable
Training modes (Curriculum, Self-Play, Offline RL)	UI ready, backend partial
Live network scanning (nmap + fingerprint)	Backend ready, UI deferred
MITRE ATT&CK + CTEM compliance reporting	Backend ready, UI deferred

---

Architecture

┌─────────────────────────────────────────────────┐
│                  Frontend (Next.js 16)            │
│  9 dashboard pages · Tailwind · ReactFlow ·     │
│  Plotly · Framer Motion · NextAuth (Google)     │
├─────────────────────────────────────────────────┤
│               API Proxy (Next.js)                 │
│        → FastAPI Backend (Uvicorn :8000)         │
├─────────────────────────────────────────────────┤
│                ARCA Core (Python)                 │
│  ┌──────────┐ ┌──────────┐ ┌──────────────────┐ │
│  │ ARCA Agent│ │ Network  │ │ Training Module   │ │
│  │ (GNN+PPO) │ │  Env     │ │ (Curriculum, SP,  │ │
│  │           │ │ (Gym)    │ │  Offline RL, BT)  │ │
│  └──────────┘ └──────────┘ └──────────────────┘ │
│  ┌──────────┐ ┌──────────┐ ┌──────────────────┐ │
│  │ CVE DB v5│ │ Reporting│ │ Live Scanner     │ │
│  │ (79 CVEs)│ │ (4 formats)│ │ (nmap, SSH)     │ │
│  └──────────┘ └──────────┘ └──────────────────┘ │
├─────────────────────────────────────────────────┤
│          Execution Backends                      │
│     Local CPU (in-process) · Kaggle GPU (push)  │
├─────────────────────────────────────────────────┤
│              Storage                             │
│     SQLite (frontend) · In-memory (backend)     │
└─────────────────────────────────────────────────┘

---

API Endpoints

Method	Path	Description
POST	/train	Start async training (local or kaggle)
GET	/train/status/{id}	Poll job status with stage/error tracking
POST	/train/cancel	Cancel in-progress training
GET	/presets	List built-in network presets
GET	/presets/{name}	Get preset details (hosts, subnets, etc.)
GET	/cves	Paginated CVE database with OS/severity filters
POST	/visualizations/topology	Network topology graph (Plotly JSON)
POST	/visualizations/vulnerability-heatmap	Host vulnerability heatmap
POST	/audit	Run security audit episode
POST	/reflect	LLM reflection on network state
POST	/reports/pdf	Generate PDF security report
WS	/ws/training	WebSocket training progress stream