Search papers, labs, and topics across Lattice.
This paper introduces a novel incident response framework that integrates decision-theoretic planning with large language model (LLM) capabilities to enhance the efficiency of security operations. By employing a digital twin for both tactical planning and operational execution, the method enables the generation of high-level response strategies that are translated into actionable commands, overcoming the limitations of traditional LLM-based approaches. The results demonstrate a significant improvement, with a 15.1% reduction in recovery execution time and a 33.6% increase in recovery rate compared to existing LLM baselines across three attack scenarios.
Automating incident response with a digital twin-enhanced LLM approach slashes recovery time by over 15% while boosting success rates by nearly 34%.
Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1\% on average and increases the recovery rate by 33.6\% over frontier LLM baselines.
