# NetMoniAI: An Agentic AI Framework for Network Security & Monitoring

arXiv: https://arxiv.org/abs/2508.10052 · HTML: https://mlsanity.com/paper/2508.10052/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use.
- Builds on 3 of its 15 references that are in the map.
- First posted on arXiv 12 Aug 2025.

## Placed in

- LLM agents and tool use / [Agent threats, guardrails and governance](https://mlsanity.com/agents/agent-threats-guardrails-and-governance/)

## Builds on (most cited first, 3 of 3)

- [A Multi-Agent Adaptive Deep Learning Framework for Online Intrusion Detection](https://mlsanity.com/paper/2303.02622/) (2023)
- [Cyber Security in the Age of COVID-19: A Timeline and Analysis of Cyber-Crime and Cyber-Attacks during the Pandemic](https://mlsanity.com/paper/2006.11929/) (2020)
- [Exploring Network-Wide Flow Data with Flowyager](https://mlsanity.com/paper/2010.13120/) (2020)

## Built on by (most cited first, 4 of 4)

- [CyberSleuth: Autonomous Blue-Team LLM Agent for Web Attack Forensics](https://mlsanity.com/paper/2508.20643/) (2025)
- [MA-IDS: Multi-Agent RAG Framework for IoT Network Intrusion Detection with an Experience Library](https://mlsanity.com/paper/2604.05458/) (2026)
- [Multi-Agent Collaborative Intrusion Detection for Low-Altitude Economy IoT: An LLM-Enhanced Agentic AI Framework](https://mlsanity.com/paper/2601.17817/) (2026)
- [Policy-Guided Threat Hunting: An LLM enabled Framework with Splunk SOC Triage](https://mlsanity.com/paper/2603.23966/) (2026)

## Abstract (arXiv)

In this paper, we present NetMoniAI, an agentic AI framework for automatic network monitoring and security that integrates decentralized analysis with lightweight centralized coordination. The framework consists of two layers: autonomous micro-agents at each node perform local traffic analysis and anomaly detection. A central controller then aggregates insights across nodes to detect coordinated attacks and maintain system-wide situational awareness. We evaluated NetMoniAI on a local micro-testbed and through NS-3 simulations. Results confirm that the two-tier agentic-AI design scales under resource constraints, reduces redundancy, and improves response time without compromising accuracy. To facilitate broader adoption and reproducibility, the complete framework is available as open source. This enables researchers and practitioners to replicate, validate, and extend it across diverse network environments and threat scenarios. Github link: https://github.com/pzambare3/NetMoniAI