发表机构
Ho Chi Minh City College of Transport; Academy of Cryptography Techniques, Ho Chi Minh City Campus; Faculty of Computer Science and Engineering, Ho Chi Minh City University of Technology (HCMUT); Vietnam National University Ho Chi Minh City（胡志明市交通学院; 越南密码技术学院胡志明市校区; 胡志明市理工大学计算机科学与工程系; 越南国立大学胡志明市分校）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文设计并评估了一个用于教育信息系统的告警后事件编排与响应子系统，通过规则引擎和本地大语言模型实现受控、可追溯的自动化处理，实验验证了其功能正确性与有界集成。
AI 中文摘要
本文针对教育信息系统提出了一种受控的告警后事件编排与响应子系统。该架构将确定性分类、上下文分析、人工审批和技术执行相分离。规则引擎确定严重性并选择剧本，而静态检索增强生成（Static RAG）和本地大语言模型在验证器、护栏、输出净化器和安全回退控制下提供咨询内容。实验在模拟告警存储到Elasticsearch后开始。规则引擎在所有30个边界案例中均匹配了预定义的路由矩阵。持久队列完成了100个事件，没有重复任务、新增失败任务或意外防火墙规则。一项八告警竞争实验保持了配置的一个活动模型请求限制，30次顺序测量显示告警后处理时间的总体平均约为33秒。结果表明，在评估的实验室范围内，该系统具有功能正确性、可追溯性、受控恢复和有界模型集成。
英文摘要
This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the playbook, while Static RAG and a local large language model provide advisory content under Validator, Guardrail, Output Sanitizer, and Safe Fallback controls. Experiments begin after simulated alerts are stored in Elasticsearch. The Rule Engine matched the predefined routing matrix in all 30 boundary cases. The Durable Queue completed 100 events without duplicate tasks, new failed tasks, or unintended firewall rules. An eight-alert contention experiment preserved the configured limit of one active model request, and 30 sequential measurements showed an overall mean post-alert processing time of approximately 33 seconds. The results demonstrate functional correctness, traceability, controlled recovery, and bounded model integration within the evaluated laboratory scope.
CommentsAccepted for publication in the Proceedings of the 19th Conference on Fundamental and Applied IT Research (FAIR'2026), Ho Chi Minh City, Vietnam, October 8-9, 2026
