PaperlayerView exact revision on arXiv

Source-linked AI summary

Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference

Yiran Gao, Juntao Chen, Tao Li

arXiv:2608.15016v1cs.CRcs.AI

TL;DR

Incident response requires labor-intensive inference and command translation from fragmented evidence. This paper combines hierarchical LLM agents, rollout planning, and digital-twin validation, improving recovery success over frontier-LLM baselines by 18–31 percentage points.

  • Problem

    Incident response relies heavily on human operators to interpret fragmented evidence and translate decisions into specific operations, limiting scalability amid cybersecurity workforce shortages.

  • Method

    A hierarchical framework combines LLM-based attack inference, decision-theoretic rollout planning, and digital-twin validation of attack replays and recovery commands.

  • Results

    Recovery success improved over frontier-LLM baselines by 18–31 percentage points across three multi-stage attack scenarios on a 33-component testbed.

  • Takeaways & Limitations

    The evaluation provides evidence for a validated hierarchical approach to automating incident-response planning and execution in the tested enterprise-network setting.

Abstract

from arXiv · show

Network incident response remains slow and labor-intensive as the defender must infer multi-stage attacks from partial observations and translate recovery decisions into reliable system commands. Decision-theoretic planners provide principled optimization but typically rely on abstract states and predefined actions, while large language model (LLM) agents can reason over operational context but may hallucinate attacks and responses. Toward automating response planning, we present a hierarchical agentic response framework that integrates LLM-based attack inference, rollout planning, and digital-twin validation. A fine-tuned LLM infers the attack progression and affected hosts from security alerts and system measurements. An emulated network digital twin replays the inferred attack and returns discrepancies between predicted and observed effects to calibrate the inference. A separately fine-tuned planning agent uses the rollout planning method to prioritize affected components at the tactical layer. At the operational layer, the planning agent proposes high-level recovery actions, and an execution agent translates selected actions into recovery and verification commands that are validated in the digital twin. We evaluate the framework on a 33-component enterprise-network testbed under three multi-stage attack scenarios. The results show that our framework outperforms frontier-LLM baselines in recovery success rate by 18--31%.

I. INTRODUCTION

The paper addresses the scalability and concreteness limitations of autonomous cyber defense by proposing a hierarchical framework that combines LLM-based attack inference, rollout planning, and digital-twin validation. It evaluates this framework on a 33-component enterprise testbed across three multi-stage attacks, achieving an 18–31 percentage-point recovery-success advantage over frontier-LLM baselines.

  • I. INTRODUCTION: Human-centered incident response requires operators to interpret fragmented evidence and translate decisions into specific operations, limiting scalability amid a cybersecurity-professional shortage.Incident response includes analysis, containment, eradication, and recovery after intrusion.
  • I. INTRODUCTION: Decision-theoretic ACD provides principled planning through abstract models but typically assumes abstract states and predefined actions, hindering reconstruction of concrete multi-stage attacks.The approaches include control and optimization, game theory, reinforcement learning, Markov decision processes, and security games.
  • I. INTRODUCTION: The proposed hierarchy uses a fine-tuned inference agent to reconstruct attack actions and hosts, rollout planning to prioritize affected components, and LLM agents to generate executable recovery commands.The digital twin replays inferred attacks for discrepancy-based calibration and verifies generated recovery commands through emulation.
  • I. INTRODUCTION: 33 interconnected components across multiple subnets form the containerized enterprise-network testbed used to evaluate three multi-stage attack scenarios with increasing capability and attack-path complexity.The environment includes multi-homed hosts, heterogeneous vulnerable services, IDS monitoring points, and lateral-movement paths.
  • I. INTRODUCTION: 18–31 percentage points is the framework’s recovery-success improvement over frontier-LLM baselines across the three multi-stage attack scenarios.The framework uses locally deployed lightweight LLM agents.

II. RELATED WORK · III. FORMALIZING INCIDENT RESPONSE PLANNING

The paper combines LLM-based attack inference, decision-theoretic hierarchical planning, and digital-twin validation for incident response. It formalizes response as a two-level partially observable decision problem over global security and component recovery states.

  • II. RELATED WORK: The framework infers attack actions and target hosts from system context and IDS observations, then calibrates the inference by replaying the attack in a digital twin.It integrates tactical planning, operational recovery generation, and digital-twin validation within one hierarchy.
  • II. RELATED WORK: Compared with closely related approaches,, the framework combines abstract-model rollout for tactical planning with digital-twin emulation for attack replay and recovery verification.The same hierarchy connects decision-theoretic tactical prioritization with LLM-generated operational recovery actions.
  • III. FORMALIZING INCIDENT RESPONSE PLANNING: Incident response is formulated at tactical and operational levels: prioritizing affected components first, then selecting recovery actions for a chosen component.Cross-level planning uses a factorized partially observable Markov decision process.
  • III. FORMALIZING INCIDENT RESPONSE PLANNING: The system state factors into network-level security posture and component-level recovery states, while defenders receive correlated IDS alerts and system measurements under partial observability.Beliefs are formed from historical observations over the hidden joint state.
  • III. FORMALIZING INCIDENT RESPONSE PLANNING: Each component’s local recovery state records six stages: containment, assessment, forensic preservation, eviction, network hardening, and service restoration.Initially safe components are assigned the terminal local state ℓR = (1, 1, 1, 1, 1, 1).
  • III. FORMALIZING INCIDENT RESPONSE PLANNING: The tactical action is a permutation specifying component priorities, and the operational action is a high-level recovery action applied to the highest-priority unrecovered compromised component.This hierarchical action structure separates global prioritization from component-level recovery.
  • III. FORMALIZING INCIDENT RESPONSE PLANNING: The attack sequence θ consists of core attack actions paired with target components and influences component-level recovery dynamics and subsequent global transitions.A component becomes safe when its local recovery state reaches complete recovery; the complete-recovery state is absorbing.
  • III. FORMALIZING INCIDENT RESPONSE PLANNING: The defender seeks a belief-based hierarchical response policy that minimizes expected cumulative recovery cost over a finite horizon under uncertainty in state and transition evolution.The planning method approximates this objective across tactical and operational levels.

IV. HIERARCHICAL PLANNING IN AGENTIC RESPONSE

The method combines offline fine-tuning with an online hierarchical response stage. It fine-tunes separate inference and planning agents for attack-sequence inference and belief/action generation.

  • Method stages: The framework has offline fine-tuning and online hierarchical response stages.The offline stage precedes the online response process.
  • Offline fine-tuning: Two variants of DeepSeek-R1-Distill-Qwen-14B are fine-tuned for the framework.Both variants are lightweight local models trained during the offline stage.
  • Offline fine-tuning: The inference agent learns from incident examples to infer the attack sequence θ.This is the first of the three instruction-response training tasks.
  • Offline fine-tuning: The planning agent generates beliefs and actions.It is the second model variant described in the offline stage.

A. Offline Fine-Tuning

The framework fine-tunes DeepSeek with LoRA on approximately 68,000 security incidents and corresponding responses. Task-specific instructions adapt the model for attack inference, state prediction, and related online functions.

  • Training data: Approximately 68,000 security incidents and corresponding responses form the open-source instruction–response corpus used for LoRA fine-tuning of DeepSeek Φw.Each example pairs task instructions and incident context with a target output sequence.
  • Optimization: The trainable parameters w are optimized with an autoregressive cross-entropy objective over target tokens and mini-batches.Li denotes the target-token count for example i, while B denotes mini-batch size.
  • Online functions: For attack inference, the fine-tuned model maps incident descriptions and IDS alerts to MITRE ATT&CK tactics, techniques, and attack sequences.This function is assigned to the inference agent in the online procedure.
  • Online functions: For state prediction, the planning agent uses the same task-instruction format and produces the labeled state st and its associated output.The supplied passage identifies state prediction as a separate task-specific function.

B. Digital Twin-Based Attack Inference and Calibration

The online stage uses an inference agent to estimate an unknown attack sequence from partial observations, then replays that conjecture in a network digital twin for consistency checking.

  • Online attack inference: The inference agent estimates the unknown attack sequence θ from partial observations including system context, IDS alerts, logs, and service measurements.The available observations are denoted o0, and the inferred conjecture is denoted ˆθ.
  • Digital-twin validation: The digital twin executes the inferred conjecture ˆθ and produces an emulated observation ˆo0 for comparison with the original observations o0.The twin replicates the affected system during this online validation stage.
  • Inference calibration: Consistency is assessed by comparing affected hosts, privilege and service states, and backdoor observations between ˆo0 and o0.The passage defines the emulated and original observations as consistent when these observed properties agree.

C. Tactical Rollout Planning

Tactical rollout planning prioritizes which affected component to recover next by evaluating candidate priority orders over sampled global states and finite-horizon simulations. It uses compromise-probability ordering and limited permutations to make planning tractable before passing the selected component to operational planning.

  • C. Tactical Rollout Planning: The inferred attack sequence identifies affected components and induces an estimated global transition model for tactical planning.At each tactical step, the planner selects the highest-priority unrecovered component and assumes it is fully recovered before the next tactical decision.
  • C. Tactical Rollout Planning: The planner evaluates candidate component-priority permutations using recovery duration and the delay imposed on other unrecovered components.For a candidate order, the highest-priority unrecovered component is recovered next, and its estimated duration determines the unweighted tactical delay cost.
  • C. Tactical Rollout Planning: Rollout evaluation samples possible global states, simulates each candidate over finite lookahead steps, and selects the tactical action with the lowest estimated rollout cost.The rollout cost is based on the simulated candidate trajectories across the lookahead horizon.
  • C. Tactical Rollout Planning: To avoid enumerating all N! priority orders, the planner initially ranks components by decreasing compromise probability and later permutes up to three leading unrecovered components.The highest-priority component under the selected order is passed to operational planning.

D. Operational Planning and Command Validation

Operational planning generates candidate high-level recovery actions for the tactically prioritized component, translates them into recovery and verification commands, and validates each plan in the digital twin. The selected plan is executed only when validation succeeds, with iterative belief updates continuing until the component is marked safe.

  • The planning agent generates candidate high-level recovery actions conditioned on the current belief, evidence summary, and previous local action.
  • Each high-level action becomes a command plan containing recovery commands and verification commands.The execution agent performs this translation as q(ˆa) = (C(ˆa), Q(ˆa)).
  • Validation first checks resource and network compatibility, then executes the plan in the emulated digital twin to verify the intended recovery.Compatibility covers containers, files, services, interfaces, and network paths.
  • Candidate plans are compared by digital-twin execution time when both validation stages pass and receive infinite cost otherwise.Command generation, compatibility checking, and checkpoint restoration are measured separately as planning overhead.
  • If all candidates have infinite cost, no operational action is committed; otherwise, execution produces observations that update beliefs and evidence until the component is marked safe.The generate–rollout–validate–execute cycle continues until the local state reaches ℓR.

V. EXPERIMENTAL EVALUATION

The experimental evaluation measures the framework’s end-to-end recovery performance using recovery time and recovery rate. Training-data construction, fine-tuning, and standalone model evaluation are referenced from prior work rather than repeated.

  • V. EXPERIMENTAL EVALUATION: The framework is evaluated end-to-end using recovery time and recovery rate.These metrics assess recovery performance.
  • V. EXPERIMENTAL EVALUATION: Training-data construction and fine-tuning procedures are reported in previous work [19].The paper does not repeat these procedures in this section.
  • V. EXPERIMENTAL EVALUATION: Standalone evaluation of the local DeepSeek-R1-Distill-Qwen-14B model is omitted because of space limitations.The model-level evaluation is referenced rather than reproduced here.

A. Experimental Setup

Experiments use a containerized enterprise-network digital twin with approximately 33 interconnected components and multi-stage scenarios of increasing attacker capability and attack-path complexity. The implementation uses a fine-tuned DeepSeek-R1-Distill-Qwen-14B inference model, two candidate recovery actions per operational step, and two Monte Carlo rollouts per candidate.

  • Digital-twin environment: Approximately 33 interconnected components form the containerized enterprise-network digital twin used for experiments.The environment spans multiple subnets and includes multi-homed hosts and heterogeneous vulnerable services.
  • Digital-twin environment: Three scenarios represent increasing attacker capability and attack-path complexity, from a comparatively short compromise path to attacks with additional exploitation and lateral movement.The scenarios involve lateral movement across multi-homed components, and Table I summarizes their core attack actions.
  • Implementation: DeepSeek-R1-Distill-Qwen-14B with the fine-tuned adapter described in [19] serves as the local inference model, using the same four-dataset LoRA configuration.At each operational decision step, the model proposes two candidate high-level recovery actions, with two Monte Carlo rollouts per candidate.

B. Metrics and Baselines

The section defines core attack-action accuracy for evaluating whether the fine-tuned LLM correctly infers attack actions from system descriptions and IDS observations.

  • Core attack-action accuracy: Core attack-action accuracy compares normalized predicted attack-action sets with reference sets across 20 predictions per scenario.Per-action accuracy is the fraction of predictions containing a given ground-truth action.

C. Results Discussion · VI. CONCLUSION

The framework combines calibrated LLM-based attack inference, hierarchical rollout planning, and digital-twin-validated recovery execution. Across three multi-stage scenarios, it achieves higher recovery success than the strongest baselines while using fewer high-level actions per recovered component.

  • C. Results Discussion: Attack-inference precision exceeds 78% across all three scenarios.The result is reported in the discussion of scenario-level attack inference.
  • C. Results Discussion: 90%, 88%, and 86% recovery success rates are achieved in the novice, experienced, and expert scenarios.These rates are compared with baseline rates of 72%, 67%, and 60%, respectively.
  • C. Results Discussion: 18, 21, and 26 percentage-point gains are obtained over the strongest baselines in the novice, experienced, and expert scenarios.The corresponding baseline success rates are 72%, 67%, and 60%.
  • C. Results Discussion: Six high-level actions are typically committed per recovered component, matching the six local recovery stages.Baselines generate seven to fifteen actions, requiring more command-generation and execution rounds.
  • VI. CONCLUSION: The framework combines LLM-based attack inference, decision-theoretic planning, and digital-twin emulation.Digital-twin replay calibrates inferred attack progression, while tactical rollout prioritizes affected components.
  • VI. CONCLUSION: Planning and execution agents generate recovery actions and commands that are validated in the digital twin.This connects tactical prioritization with operational recovery and command validation.
  • VI. CONCLUSION: The framework is evaluated on a 33-component, multi-subnet testbed under three multi-stage attack scenarios.The conclusion identifies this testbed and scenario configuration as the evaluation setting.
Loading 2608.15016v1…