CHARLES: Continuous Homeostatic Adversarial Resilience through Learning and Epistemic Sifting

Autonomous learning-based cyber attackers and AI agents introduce a shift in the cybersecurity threat landscape, where adversaries can continuously adapt their behaviour based on observed defensive responses. Traditional defensive mechanisms often rely on static configurations or predefined responses, which may become predictable to adaptive attackers. This paper proposes CHARLES (Continuous Homeostatic Adversarial Resilience through Learning and Epistemic Sifting), a conceptual defensive architecture designed to continuously manage the information and environmental conditions available to autonomous attackers. CHARLES integrates four primary components: an Epistemic Sifting Engine (ESE), an Adaptive State Transformation Engine (ASTE), an Adversarial Learning Estimator (ALE), and an Adversarial Utility Management Engine (AUME). These components operate within a continuous Observe–Estimate–Sift–Transform–Evaluate–Adapt loop, enabling the defender to modify observable system states, introduce controlled deception, estimate attacker adaptation, and manage adversarial utility. The framework is designed to increase environmental uncertainty, reduce attacker utility, and disrupt stable learning behaviour without relying solely on static defensive configurations. A threat model involving reinforcement-learning-based autonomous attackers is defined, together with proposed experimental conditions comparing static defence, moving target defence, cyber deception, and the complete CHARLES architecture. Evaluation metrics include attack success, completion time, policy stability, adaptation behaviour, attacker uncertainty, defensive latency, resource consumption, and legitimate service disruption. CHARLES is presented as a conceptual research framework and hypothesis rather than a validated defensive system. Future work will implement and experimentally evaluate the architecture using reinforcement-learning attackers, multi-agent environments, and established cyber-range platforms.