Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference

2026-08-15

AI Summary

This study addresses the challenges of delayed cyber incident response and unreliable recovery instructions caused by large language model hallucinations. We propose a hierarchical agent framework that integrates attack inference, reasoning-based planning, and digital twin verification. By leveraging a digital twin calibration mechanism alongside multi-agent collaboration, this approach effectively mitigates model hallucinations and enables automated decision-making. Experiments conducted on an enterprise network testbed demonstrate that our method improves recovery success rates by 18% to 31% compared to state-of-the-art LLM baselines. These results indicate a significant enhancement in the accuracy and reliability of response decisions within complex, multi-stage attack scenarios, offering a robust solution for autonomous cyber defense.

Abstract

Network incident response remains slow and labor-intensive as the defender must infer multi-stage attacks from partial observations and translate recovery decisions into reliable system commands. Decision-theoretic planners provide principled optimization but typically rely on abstract states and predefined actions, while large language model (LLM) agents can reason over operational context but may hallucinate attacks and responses. Toward automating response planning, we present a hierarchical agentic response framework that integrates LLM-based attack inference, rollout planning, and digital-twin validation. A fine-tuned LLM infers the attack progression and affected hosts from security alerts and system measurements. An emulated network digital twin replays the inferred attack and returns discrepancies between predicted and observed effects to calibrate the inference. A separately fine-tuned planning agent uses the rollout planning method to prioritize affected components at the tactical layer. At the operational layer, the planning agent proposes high-level recovery actions, and an execution agent translates selected actions into recovery and verification commands that are validated in the digital twin. We evaluate the framework on a 33-component enterprise-network testbed under three multi-stage attack scenarios. The results show that our framework outperforms frontier-LLM baselines in recovery success rate by 18--31%.

Problem

• Incident Response
• Attack Inference
• LLM Hallucination
• Automated Response Planning
• Digital Twin Validation

Innovation

• Hierarchical Agentic Framework
• Digital-Twin Validation
• LLM-based Attack Inference
• Rollout Planning
• Automated Incident Response