🤖 AI

In-Context Autonomous Network Incident Response: An End-to-End Large Language Model Agent Approach

This paper proposes an end-to-end, lightweight LLM agent that leverages in-context learning and chain-of-thought reasoning to autonomously perceive, reason, plan, and act in network incident response without requiring handcrafted simulators, achieving up to 23% faster recovery than frontier models.

Original authors: Yiran Gao, Kim Hammar, Tao Li

Published 2026-04-16

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yiran Gao, Kim Hammar, Tao Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine your computer network is a massive, high-tech castle. Every day, invisible thieves (hackers) try to sneak in, break locks, and steal treasure.

The Old Way: The Exhausted Guard
Traditionally, when an alarm rings, a human security guard has to run to the scene, read a 50-page manual, figure out what happened, and then decide what to do. This is slow, tiring, and by the time they act, the thieves might have already escaped.

The "Smart Robot" Attempt (Reinforcement Learning)
Scientists tried to build a robot guard that learns by playing a video game of "Cyber Castle Defense." They programmed the robot to simulate millions of attacks in a virtual world.

The Problem: To play the game, the scientists had to translate the messy, real-world security logs (which are full of human-readable text) into simple numbers (0s and 1s). It's like trying to describe a Shakespeare play using only emojis. The robot learned the game rules but lost the meaning of the story. Also, building the game world required massive manual effort.

The New Solution: The "Super-Intern" with a Crystal Ball
This paper introduces a new kind of AI agent based on a Large Language Model (LLM). Think of this agent not as a calculator, but as a super-smart, well-read security intern who has read every book on cybersecurity ever written.

Here is how this "Super-Intern" works, broken down into four simple steps:

1. Perception (The Detective)

Instead of translating logs into boring numbers, the intern reads the actual security alerts and system logs just like a human would.

Analogy: If the log says "The front door is open and someone is running with a bag," the intern understands the story, not just the data points. It figures out the current state of the castle: "Is the thief inside? Do we know where they are?"

2. Reasoning (The Crystal Ball)

The intern doesn't just look at the present; it uses its vast knowledge to guess what will happen next. It builds an internal "World Model."

Analogy: It asks, "If I lock the front door, will the thief try the back window? If I cut the power, will they panic and run?" It simulates the future in its head.

3. Planning (The Rehearsal)

This is the magic trick. Before doing anything, the intern runs a mental rehearsal. It tries out different strategies (Action A, Action B, Action C) in its imagination to see which one fixes the problem fastest.

Analogy: It's like a chess player thinking, "If I move my knight here, he moves his pawn there... oh no, that's a trap. Let's try moving the bishop instead." It simulates the whole recovery process in its mind to find the best path.

4. Action & Adaptation (The Flexible Commander)

The intern picks the best plan and executes it. But here's the kicker: it learns in real-time.

The Twist: If the intern predicts the thief will run to the back door, but the thief actually runs to the front, the intern realizes, "Oops, my guess was wrong!" It immediately updates its mental model of the thief's behavior and changes the plan on the fly.
Analogy: It's like a GPS that doesn't just give you a route, but if you hit a traffic jam, it instantly recalculates a new path without you having to tell it to.

Why is this a big deal?

No "Game World" Needed: Unlike the old robot, this intern doesn't need a pre-built video game. It understands real-world text and logs directly.
Small but Mighty: The authors used a relatively small model (14 billion parameters), which means it can run on standard computer hardware, not just supercomputers.
Speed: In tests, this agent recovered the network 23% faster than other top-tier AI models. It didn't get confused or make up fake solutions (hallucinations) because it constantly checks its own predictions against reality.

The Catch

The only downside is that running these mental rehearsals takes a bit of computing power. If the network is huge and the attack is incredibly complex, the "thinking" process takes about 20 minutes. The authors admit they need to make this thinking process faster for the future.

In a nutshell: This paper proposes a security AI that reads like a human, thinks like a chess grandmaster, and adapts like a seasoned detective, all without needing to be taught a rigid video game first. It's a step toward computers that can truly "think" their way out of a cyber crisis.

1. Problem Statement

Network incident response (IR) is critical for containing and recovering from cyberattacks, yet current practices rely heavily on manual operations, leading to slow recovery times (often exceeding 100 days).

Limitations of Reinforcement Learning (RL): Prior automated approaches using RL require extensive, handcrafted simulation environments. These models compress rich system logs and alerts into succinct numeric data, suppressing valuable semantic information and requiring significant manual engineering.
Limitations of Standard LLMs: While Large Language Models (LLMs) excel at processing unstructured text and possess pre-trained security knowledge, general-purpose LLMs suffer from hallucinations (generating plausible but incorrect actions) and context loss in long-horizon planning (losing track of prior steps as history grows).
Goal: To create an autonomous, end-to-end IR agent that leverages LLM capabilities without requiring structured environment modeling, while mitigating hallucinations and ensuring coherent long-term planning.

2. Methodology

The authors propose an LLM Agent that integrates four core functionalities—Perception, Reasoning, Planning, and Action—into a single lightweight model (14 billion parameters). The approach is modeled as a Partially Observable Markov Decision Process (POMDP) and operates in two stages:

A. Offline Fine-Tuning (Perception & Reasoning)

The base LLM (DeepSeek-14B) is fine-tuned using LoRA (Low-Rank Adaptation) on a dataset of 50,000 instruction-answer pairs derived from incident logs.

Perception: The agent processes raw logs and alerts to infer the underlying Recovery State ( $\hat{s}_t$ ). The state is a 6-dimensional Boolean vector representing: Containment, Assessment, Preservation, Eviction, Hardening, and Restoration.
Reasoning (World Model): The agent learns to predict future observations (alerts) and state transitions based on the current state and conjectured attack tactics (MITRE ATT&CK). This creates an internal "world model" to simulate consequences.
Training: Uses Chain-of-Thought (CoT) reasoning traces to teach the model how to derive answers, improving logical consistency.

B. Online Response Planning (Planning & Action)

During an active incident, the agent executes an Online Conjectural Lookahead Planning loop:

Conjecture Tactics: The agent hypothesizes the attacker's tactics ( $\hat{\theta}$ ) based on current logs.
Generate Candidates: It generates $N$ candidate response actions ( $A_t$ ).
Lookahead Simulation (Rollout): For each candidate action, the agent simulates $M$ recovery trajectories using its internal world model. It estimates the cumulative time cost ( $Q$ -value) to reach the terminal state (fully recovered).
Selection: The action with the lowest estimated cost is selected.
In-Context Adaptation (Calibration): After executing an action, the agent compares predicted alerts with actual observed alerts.
- If a significant discrepancy exists, the agent (assisted by a frontier LLM like GPT-5.2 via API) recalibrates its conjecture of the attack tactics ( $\hat{\theta}$ ).
- The planning loop repeats with the updated context, ensuring self-consistency and correcting for model mis-specification.

3. Key Contributions

End-to-End Agentic Workflow: A unified framework that maps raw logs directly to response sequences without intermediate numeric modeling or handcrafted simulators.
Integration of RL Principles into LLMs: The paper distills RL concepts (POMDP, Monte-Carlo Tree Search, lookahead rollout) into LLM prompting and fine-tuning strategies to address hallucinations and context loss.
In-Context Adaptation Mechanism: A novel feedback loop where the agent dynamically refines its internal "world model" (attack tactics) by comparing simulated outcomes with real-world observations, allowing for adaptation to evolving threats.
Lightweight Deployment: The solution runs on a 14B parameter model, deployable on commodity hardware, contrasting with the heavy infrastructure often required for RL or massive frontier models.

4. Experimental Results

The agent was evaluated on four diverse datasets (CTU-Malware-2014, CIC-IDS-2017, AIT-IDS-V2-2022, CSLE-IDS-2024) against three frontier LLMs (DeepSeek-R1, Gemini 2.5 Pro, OpenAI O3).

Performance: The proposed agent achieved 23% faster recovery times compared to the frontier LLMs.
Accuracy:
- State Estimation: Achieved an exact-match accuracy of 0.98 and high F1 scores (approx. 0.99) for predicting the 6-dimensional recovery state.
- Alert Prediction: Demonstrated strong capability in predicting IDS alert classifications and priorities, particularly under active attack scenarios.
Ablation Study:
- Removing Fine-tuning or Planning significantly degraded performance, confirming their critical role.
- Removing Context Adaptation showed a modest performance drop, suggesting its value lies more in long-horizon or complex scenarios than short sequences.
Failure Rates: The proposed agent maintained failure rates comparable to frontier models but was far more efficient in successful recovery paths.

5. Significance and Future Work

Significance: This work bridges the gap between the semantic understanding of LLMs and the strategic planning capabilities of RL. It offers a practical, model-free approach to autonomous cyber defense that reduces reliance on manual simulation engineering.
Scalability Limitation: The current approach relies on Monte-Carlo tree search, which scales as $O(MN)$. Processing complex, long-horizon incidents currently takes ~20 minutes per incident on an A100 GPU.
Future Directions:
- Developing cost-efficient simulation or parallel computing methods to speed up the lookahead planning.
- Enhancing evaluation metrics with more realistic time costs and longer action sequences to better test the in-context adaptation capabilities.
- Integrating external threat intelligence directly into the agent's calibration loop without relying on external API calls for frontier models.

In conclusion, the paper presents a robust, adaptive agent that leverages the "world model" capabilities of fine-tuned LLMs to autonomously plan and execute incident response, significantly outperforming current state-of-the-art models in efficiency and recovery speed.