mlsanityData to 14 Oct 2026

IRSDA: An Agent-Orchestrated Framework for Enterprise Intrusion Response

arXiv 2511.19644 ↗First posted 24 Nov 2025cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Modern enterprise systems face escalating cyber threats that are increasingly dynamic, distributed, and multi-stage in nature. Traditional intrusion detection and response systems often rely on static rules and manual workflows, which limit their ability to respond with the speed and precision required in high-stakes environments. To address these challenges, we present the Intrusion Response System Digital Assistant (IRSDA), an agent-based framework designed to deliver autonomous and policy-compliant cyber defense. IRSDA combines Self-Adaptive Autonomic Computing Systems (SA-ACS) with the Knowledge guided Monitor, Analyze, Plan, and Execute (MAPE-K) loop to support real-time, partition-aware decision-making across enterprise infrastructure. IRSDA incorporates a knowledge-driven architecture that integrates contextual information with AI-based reasoning to support system-guided intrusion response. The framework leverages retrieval mechanisms and structured representations to inform decision-making while maintaining alignment with operational policies. We assess the system using a representative real-world microservices application, demonstrating its ability to automate containment, enforce compliance, and provide traceable outputs for security analyst interpretation. This work outlines a modular and agent-driven approach to cyber defense that emphasizes explainability, system-state awareness, and operational control in intrusion response.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 22 of its 52 references that are in the map. First posted on arXiv 24 Nov 2025.

Builds on

22 of 52 references.

References · 22

  1. 2020Language Models are Few-Shot Learnerscited by 32,419
  2. 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
  3. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
  4. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  5. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  6. 2024From Local to Global: A Graph RAG Approach to Query-Focused Summarizationcited by 1,453
  7. 2022Atlas: Few-shot Learning with Retrieval Augmented Language Modelscited by 952
  8. 2023A Comprehensive Overview of Large Language Modelscited by 648
  9. 2018Deep Reinforcement Learning for Multi-Agent Systems: A Review of Challenges, Solutions and Applicationscited by 127
  10. 2024GRAG: Graph Retrieval-Augmented Generationcited by 78
  11. 2024garak: A Framework for Security Probing Large Language Modelscited by 49
  12. 2024When Large Language Models Meet Vector Databases: A Surveycited by 39
10 more
  1. 2022CySecBERT: A Domain-Adapted Language Model for the Cybersecurity Domaincited by 31
  2. 2024LOCALINTEL: Generating Organizational Threat Intelligence from Global and Local Cyber Knowledgecited by 22
  3. 2024Grounding and Evaluation for Large Language Models: Practical Challenges and Lessons Learned (Survey)cited by 20
  4. 2024Use of Graph Neural Networks in Aiding Defensive Cyber Operationscited by 7
  5. 2022An Intrusion Response System utilizing Deep Q-Networks and System Partitionscited by 6
  6. 2025LLMZ+: Contextual Prompt Whitelist Principles for Agentic LLMscited by 5
  7. 2025FALCON: Transforming Cyber Threat Intelligence into Deployable IDS Rules with Self-Reflectioncited by 4
  8. 2025Towards Secure MLOps: Surveying Attacks, Mitigation Strategies, and Research Challengescited by 3
  9. 2024Ignore Me But Don't Replace Me: Utilizing Non-Linguistic Elements for Pretraining on the Cybersecurity Domaincited by 2
  10. 2024IRSKG: Unified Intrusion Response System Knowledge Graph Ontology for Cyber Defensecited by 1

Built on by

Not cited yet.