SoK：衡量闭环安全智能体的核心指标
SoK: Measuring What Matters for Closed-Loop Security Agents
AI总结：
针对网络安全领域闭环安全智能体研究缺乏统一评估框架与基准的问题，提出CLASP框架与CLC分数，梳理现有研究的能力缺口，为闭环安全智能体评估提供通用标准与测量手段。
摘要：
网络安全是一场永不停歇的军备竞赛，AI驱动的攻击系统演进速度远超传统防御的适应能力。相关研究与工具仍分散在孤立的防御功能模块中，形成了攻击者可利用的盲区。能够将漏洞利用确认、修复和验证整合到单一闭环中的自主智能体颇具前景，但该领域缺乏三项核心要素：一套定义安全系统在整个安全生命周期中智能体能力的框架、一种评估闭环智能体的原则性方法，以及一个在实际场景中衡量其性能的基准。我们提出CLASP（闭环自主安全性能框架），将安全生命周期（侦察、漏洞利用、根因分析、补丁生成、验证）与核心智能体能力（规划、工具使用、记忆、推理、反思与感知）对应起来，为评估安全任务中的智能体能力提供了通用术语体系和评估标准。通过将CLASP应用于21项代表性研究，我们梳理了现有系统的优势所在，以及仍存在的能力缺口。随后我们定义了闭环能力（CLC）分数——这是一种同时量化闭环闭合程度与运行效能的复合指标，并概述了闭环基准的构建要求。CLASP与CLC分数共同提供了推动功能层面性能提升、衡量闭环安全智能体所需的术语体系、诊断方法与测量手段。
英文摘要：
Cybersecurity is a relentless arms race, with AI driven offensive systems evolving faster than traditional defenses can adapt. Research and tooling remain fragmented across isolated defensive functions, creating blind spots that adversaries exploit. Autonomous agents capable of integrating, exploit confirmation, remediation, and validation into a single closed loop offer promise, but the field lacks three essentials: a framework defining the agentic capabilities of security systems across security life cycle, a principled method for evaluating closed loop agents, and a benchmark for measuring their performance in practice. We introduce CLASP: the Closed-Loop Autonomous Security Performance framework which aligns the security lifecycle (reconnaissance, exploitation, root cause analysis, patch synthesis, validation) with core agentic capabilities (planning, tool use, memory, reasoning, reflection & perception) providing a common vocabulary and rubric for assessing agentic capabilities in security tasks. By applying CLASP to 21 representative works, we map where systems demonstrate strengths, and where capability gaps persist. We then define the Closed-Loop Capability (CLC) Score, a composite metric quantifying both degree of loop closure and operational effectiveness, and outline the requirements for a closed loop benchmark. Together, CLASP and the CLC Score, provide the vocabulary, diagnostics, and measurements needed to advance both function level performance and measure closed loop security agents.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
