arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新，休息一下吧，周末愉快~~
arXiv 2604.20134cs.CRcs.AIcs.CL
收藏

AgentSOC: 一种多层代理AI框架用于安全运营自动化

AgentSOC: A Multi-Layer Agentic AI Framework for Security Operations Automation

IEEE

Joyjit Roy, Samaresh Kumar Singh

备注：
7 pages, 6 figures, 2 tables. Peer-reviewed paper published in IEEE ICAIC 2026 (IEEE Xplore)
发表信息：
2026 IEEE 5th International Conference on AI in Cybersecurity (ICAIC), Houston, TX, USA, 2026
阅读 PDF
arXiv 页面 ↗HTML 原文 ↗

AI总结：

AgentSOC通过整合感知、前瞻性推理和基于风险的行动规划，提升安全运营中心自动化水平，实现警报标准化、上下文丰富化及安全响应合规性。

摘要：

安全运营中心（SOCs）日益面临在关联异构警报、解释多阶段攻击进程和选择安全有效响应行动方面的困难。本文引入AgentSOC，一种多层代理AI框架，通过整合感知、前瞻性推理和基于风险的行动规划，增强SOC自动化能力。所提出的架构通过多层抽象整合，提供单一操作循环，支持警报标准化、上下文丰富、假设生成、结构可行性验证及政策合规响应。在大型企业环境中概念性评估表明，AgentSOC提升了事件分拣一致性，预测攻击者意图，并提供操作可行且在安全效果与操作影响之间平衡的推荐遏制选项。结果表明，混合代理推理有潜力成为开发适应性强、更安全SOC自动化的基础。此外，使用LANL认证数据的最小证明概念（POC）演示展示了所提架构的可行性。

英文摘要：

Security Operations Centers (SOCs) increasingly encounter difficulties in correlating heterogeneous alerts, interpreting multi-stage attack progressions, and selecting safe and effective response actions. This study introduces AgentSOC, a multi-layered agentic AI framework that enhances SOC automation by integrating perception, anticipatory reasoning, and risk-based action planning. The proposed architecture consolidates several layers of abstraction to provide a single operational loop to support normalizing alerts, enriching context, generating hypotheses, validating structural feasibility, and executing policy-compliant responses. Conceptually evaluated within a large enterprise environment, AgentSOC improves triage consistency, anticipates attackers' intentions, and provides recommended containment options that are both operationally feasible and well-balanced between security efficacy and operational impact. The results suggest that hybrid agentic reasoning has the potential to serve as a foundation for developing adaptive, safer SOC automation in large enterprises. Additionally, a minimal Proof-Of-Concept (POC) demonstration using LANL authentication data demonstrated the feasibility of the proposed architecture.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。

↑