arXiv 2607.032332026-07-07cs.CRcs.AIcs.IRcs.SI

用于开源情报和网络调查的智能与生成式人工智能：分类法、评估、挑战及未来方向

Agentic and Generative AI for Open-Source Intelligence and Cyber Investigations: Taxonomy, Evaluation, Challenges, and Future Directions

School of Computer Science and Mathematics, Keele University（基尔大学计算机科学与数学学院）；Cybersecurity Institute, University of Liverpool（利物浦大学网络安全研究所）；Department of Applied Computing IICL, University of Wales Trinity Saint David（威尔士特里尼达大学应用计算系）；Deakin Cyber Research and Innovation Hub, Deakin University（德金大学网络安全研究与创新中心）；Department of Information Systems and Cyber Security, The University of Texas at San Antonio（德克萨斯大学圣安东尼奥分校信息系与网络安全系）

Eduardo Almeida Palmieri, Mohamed Chahine Ghanem, Dipo Dunsin, Zubair Baig, Ed de Quincey, Kim-Kwang Raymond Choo

备注：: 36 Pages

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

研究指出公开数字信息增长使人工开源情报分析不足，大语言模型等成解决方案但评估框架滞后。通过综述74项研究，明确智能人工智能类别，找出幻觉验证差距，映射研究到情报生命周期并给出研究议程。

摘要：

公开可用数字信息的快速增长使得手动开源情报（OSINT）分析不足以应对现代情报、网络安全和网络调查。能够使用工具、进行多步推理和迭代情报生成的大语言模型（LLMs）和智能人工智能系统已成为有前景的解决方案，但评估框架未能跟上所报告的能力。本综述系统地回顾了74项研究并做出了四项贡献。首先，它将智能人工智能确立为一个独特的分析类别，而不是大语言模型提示的扩展，通过一个11类分类法组织文献，涵盖大语言模型基础、智能架构、检索增强生成（RAG）、知识图谱、提示工程、领域适应、评估基准和风险。其次，它将幻觉验证差距确定为一个语料库层面的发现：尽管在二十多项研究中幻觉被认为是一个主要的可靠性问题，但在仅一个基于OSINT特定RAG的系统中对端到端幻觉进行了实证测量，条件不可重现，而相关的推理和事实校正研究评估的是通用领域问答而非OSINT。第三，它将现有研究映射到OSINT生命周期，显示出对收集和分析的有力支持，但对验证、报告、传播和决策支持的覆盖有限。第四，它得出了一个十点研究议程，涉及评估、基准测试、幻觉测量、对抗鲁棒性、暗网覆盖、多模态情报和治理。它得出结论，人机协同驾驶模型，即大语言模型协助收集和分类，而分析师保留对验证和决策的责任，代表了最具防御性的近期部署架构。

英文摘要：

The rapid growth of publicly available digital information has rendered manual open-source intelligence (OSINT) analysis insufficient for modern intelligence, cybersecurity, and cyber investigation. Large language models (LLMs) and agentic AI systems, capable of tool use, multi-step reasoning, and iterative intelligence generation, have emerged as promising solutions, yet evaluation frameworks have not kept pace with reported capabilities. This survey systematically reviews 74 studies and makes four contributions. First, it establishes agentic AI as a distinct analytical category rather than an extension of LLM prompting, organising the literature through an 11-category taxonomy covering LLM foundations, agentic architectures, retrieval-augmented generation (RAG), knowledge graphs, prompt engineering, domain adaptation, evaluation benchmarks, and risk. Second, it identifies the hallucination-validation gap as a corpus-level finding: although hallucination is recognised as a major reliability concern in over twenty studies, end-to-end hallucination is empirically measured in only one OSINT-specific RAG-based system, non-reproducible conditions, while related reasoning and factual-correction studies evaluate general-domain question answering rather than OSINT. Third, it maps existing research to the OSINT lifecycle, showing strong support for collection and analysis but limited coverage of verification, reporting, dissemination, and decision support. Fourth, it derives a ten-point research agenda addressing evaluation, benchmarking, hallucination measurement, adversarial robustness, dark-web coverage, multimodal intelligence, and governance. It concludes that a human-AI co-pilot model, where LLMs assist collection and triage while analysts retain responsibility for verification and decision-making, represents the most defensible near-term deployment architecture.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。