Rapidly evolving cyberattacks demand incident response systems that can autonomously learn and adapt to changing threats. Prior work has extensively explored the reinforcement learning approach, which involves learning response strategies through extensive simulation of the incident. While this approach can be effective, it requires handcrafted modeling of the simulator and suppresses useful semantics from raw system logs and alerts. To address these limitations, we propose to leverage large language models' (LLM) pre-trained security knowledge and in-context learning to create an end-to-end agentic solution for incident response planning. Specifically, our agent integrates four functionalities, perception, reasoning, planning, and action, into one lightweight LLM (14b model). Through fine-tuning and chain-of-thought reasoning, our LLM agent is capable of processing system logs and inferring the underlying network state (perception), updating its conjecture of attack models (reasoning), simulating consequences under different response strategies (planning), and generating an effective response (action). By comparing LLM-simulated outcomes with actual observations, the LLM agent repeatedly refines its attack conjecture and corresponding response, thereby demonstrating in-context adaptation. Our agentic approach is free of modeling and can run on commodity hardware. When evaluated on incident logs reported in the literature, our agent achieves recovery up to 23% faster than those of frontier LLMs.

翻译：快速演变的网络攻击要求事件响应系统能够自主学习并适应不断变化的威胁。先前研究广泛探索了强化学习方法，该方法通过大量模拟事件来学习响应策略。尽管该方法可能有效，但需要手工构建模拟器模型，并抑制了原始系统日志和告警中的有用语义信息。为应对这些局限性，我们提出利用大语言模型（LLM）预训练的安全知识与上下文学习能力，构建端到端的智能体解决方案以实现事件响应规划。具体而言，我们的智能体将感知、推理、规划与执行四项功能集成于一个轻量化LLM（140亿参数模型）中。通过微调与思维链推理，该LLM智能体能够处理系统日志并推断底层网络状态（感知），更新其对攻击模型的推测（推理），模拟不同响应策略下的后果（规划），并生成有效响应（执行）。通过对比LLM模拟结果与实际观测数据，该智能体持续优化其攻击推测与对应响应策略，从而展现上下文自适应能力。我们的智能体方法无需建模过程，可在商用硬件上运行。基于文献报道的事件日志进行评估，该智能体实现恢复速度比前沿LLM快达23%。