💻 computer science

Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference

This paper presents a hierarchical agentic framework that integrates fine-tuned LLMs for attack inference, digital-twin validation for calibration, and rollout planning to automate multi-stage incident response, achieving a significantly higher recovery success rate than frontier LLM baselines on an enterprise network testbed.

Original authors: Yiran Gao, Juntao Chen, Tao Li

Published 2026-08-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yiran Gao, Juntao Chen, Tao Li

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

When a network is breached, the clock starts ticking against a silent, invisible enemy. The defenders face a chaotic puzzle: they see scattered alarms and strange data spikes, but they cannot see the full story of how the intruder moved, what they touched, or where they might strike next. Making the right move in this fog requires two difficult things: first, to correctly guess the attacker's path from incomplete clues, and second, to choose a sequence of repairs that stops the damage without causing new problems. For decades, security teams have relied on human experts to piece this together, a slow and exhausting process that often fails when the attack is complex or the team is small. The field of autonomous defense seeks to replace this human labor with intelligent systems that can think, plan, and act on their own, but building a machine that can reason about a cyberattack without making dangerous mistakes has remained a stubborn challenge.

A new study by researchers at City University of Hong Kong and Fordham University offers a fresh approach to this problem by combining three distinct tools into a single, layered system. They built a framework where artificial intelligence does not just guess the answer, but tests its own guesses before acting. The system begins with a specialized language model that acts as a detective, reading security logs and system data to reconstruct the likely sequence of an attack. Instead of accepting this reconstruction immediately, the system runs the suspected attack sequence inside a "digital twin"—a virtual replica of the real network that mimics its behavior perfectly. If the virtual attack produces the same results as the real alarms, the system knows its guess is correct. If the virtual results differ, the system sends the discrepancy back to the detective model to revise its story. This cycle of guessing, testing, and correcting ensures that the plan is built on a solid understanding of reality, not a hallucination.

Once the system is confident about what happened, it moves to the planning phase, which is split into two levels of decision-making. The first level, the tactical layer, looks at the entire network to decide which broken parts to fix first. It uses a method that simulates many possible futures to find the order of repairs that will cause the least amount of total downtime. The second level, the operational layer, takes the specific component chosen by the tactical planner and figures out exactly how to fix it. Here, another artificial intelligence agent proposes high-level recovery steps, such as isolating a server or resetting a password. Before these steps are ever applied to the real network, a third agent translates them into specific computer commands and runs them through the digital twin again. This final check verifies that the commands will actually work and will not accidentally crash the system. Only after passing this rigorous simulation does the system execute the recovery on the actual network.

The researchers tested this framework on a realistic, containerized network testbed containing thirty-three interconnected components, simulating three different types of multi-stage attacks ranging from simple to highly sophisticated. They compared their system against other advanced artificial intelligence models that rely on standard prompting without this layered verification. The results showed a clear advantage for the new approach. In the simplest attack scenario, their framework succeeded in fully recovering the network 90 percent of the time, while the best competing models succeeded only 72 percent of the time. As the attacks became more complex, the gap widened, with the new system maintaining success rates between 86 and 88 percent, compared to 60 to 67 percent for the others. This represents an improvement of eighteen to thirty-one percentage points in recovery success. Furthermore, the system was more efficient, typically committing to a concise sequence of six high-level actions per component, whereas the competing models often generated seven to fifteen actions, leading to longer and more variable execution times.

The study demonstrates that grounding artificial intelligence in a simulated reality can significantly reduce the risk of error in high-stakes environments. By forcing the system to replay its own theories and verify its commands in a safe, virtual space before touching the real world, the researchers created a loop of accountability that pure language models lack. The work does not claim to have solved every problem in cyber defense, but it provides a concrete method for making automated responses more reliable. The findings suggest that the future of autonomous security may not lie in making the artificial intelligence smarter in isolation, but in giving it a sandbox to practice its moves, ensuring that when it finally acts, it does so with precision and confidence.

Technical Summary: Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference

Problem Statement
Network incident response remains a slow, labor-intensive process where human operators must interpret fragmented evidence to infer multi-stage attacks and translate recovery decisions into reliable system commands. Existing autonomous cyber defense (ACD) approaches face significant limitations: decision-theoretic planners (e.g., Markov Decision Processes, Reinforcement Learning) rely on abstract states and predefined actions, struggling to reconstruct concrete attacks from partial observations or translate tactics into executable commands. Conversely, Large Language Model (LLM) agents can reason over operational context but often hallucinate attack sequences and responses, lacking the rigorous optimization and validation required for reliable defense.

Methodology
The authors propose a hierarchical agentic framework that integrates LLM-based inference, decision-theoretic rollout planning, and digital-twin validation to bridge the gap between inference, tactical planning, and operational execution. The system operates through the following stages:

Offline Fine-Tuning: Two variants of a lightweight local model (DeepSeek-R1-Distill-Qwen-14B) are fine-tuned using Low-Rank Adaptation (LoRA) on a corpus of 68,000 security incidents.
- The Inference Agent is trained to reconstruct attack sequences (tactics, techniques, and target hosts) from system context and IDS alerts.
- The Planning Agent is trained to generate state beliefs and high-level recovery actions based on evidence summaries.
- A separate Execution Agent (powered by Qwen3.6-27B) translates high-level actions into specific recovery and verification commands.
Online Hierarchical Response:
- Attack Inference & Calibration: The inference agent estimates the unknown attack sequence ( $\theta$ ) from partial observations. This sequence is replayed in a network digital twin. If the twin's observable effects (e.g., compromised hosts, privilege states) do not match the actual incident observations, the discrepancies are fed back to the inference agent to revise the sequence. This calibration loop ensures the inferred attack model is consistent with reality before planning begins.
- Tactical Planning (Rollout): A lookahead rollout planner prioritizes affected components. It samples global security states from a belief distribution and simulates candidate priority orders over a finite horizon. The planner minimizes an unweighted aggregate recovery-delay cost, effectively determining which compromised component to address next.
- Operational Planning & Validation: For the prioritized component, the planning agent proposes candidate high-level recovery actions. Each candidate is translated into a command plan by the execution agent. These plans undergo two validation stages in the digital twin: (1) compatibility checking with available system resources, and (2) execution to verify the intended state transition. The system uses Monte Carlo estimates of verified recovery costs to select the optimal action.

Key Contributions

Hierarchical Framework: The paper introduces a unified framework that integrates attack inference, tactical recovery planning, and operational execution. It combines decision-theoretic rollout for efficient tactical prioritization with LLM agents for context-specific action generation.
Digital-Twin Grounding: Unlike methods assuming known incident states, this approach grounds both inference and planning in a network digital twin. Inferred attacks are calibrated against observable effects, and recovery commands are validated via emulation before execution.
Implementation and Evaluation: The framework is implemented using locally deployed lightweight LLM agents and evaluated on a 33-component, containerized enterprise-network testbed across three multi-stage attack scenarios (Novice, Experienced, Expert).

Results
The framework was evaluated against frontier-LLM baselines under three attack scenarios with increasing complexity.

Recovery Success Rate: The proposed framework outperformed baselines by 18–31 percentage points, achieving success rates of 90%, 88%, and 86% in the Novice, Experienced, and Expert scenarios, respectively (compared to 72%, 67%, and 60% for baselines).
Attack Inference: The fine-tuned inference agent achieved precision exceeding 78% across all scenarios. Calibration via the digital twin further improved per-action inference accuracy (e.g., improving FTP dictionary attack inference from 25% to 55% in the Novice scenario).
Efficiency: The framework achieved the shortest mean operational execution time in every scenario. The planning agent typically committed six high-level actions per component (matching the six response stages), whereas baselines generated 7–15 actions, leading to longer and more variable execution times.

Significance
The paper claims that its primary significance lies in addressing the scalability and reliability gaps in autonomous cyber defense. By integrating LLM reasoning with decision-theoretic optimization and digital-twin validation, the framework overcomes the hallucination risks of pure LLM approaches and the abstraction limitations of traditional decision-theoretic models. The results demonstrate that grounding LLM agents in a validated digital twin environment significantly improves the reliability of attack reconstruction and the success rate of automated recovery operations in complex, multi-stage network intrusions.

Technical Summary: Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference

More like this