# Advancing LLM-Based Security Automation with Customized Group Relative Policy Optimization for Zero-Touch Networks

arXiv: https://arxiv.org/abs/2512.09485 · HTML: https://mlsanity.com/paper/2512.09485/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 24 of its 67 references that are in the map.
- First posted on arXiv 10 Dec 2025.

## Builds on (most cited first, 24 of 24)

- [Proximal Policy Optimization Algorithms](https://mlsanity.com/paper/1707.06347/) (2017)
- [DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models](https://mlsanity.com/paper/2402.03300/) (2024)
- [Playing Atari with Deep Reinforcement Learning](https://mlsanity.com/paper/1312.5602/) (2013)
- [Deep Reinforcement Learning with Double Q-learning](https://mlsanity.com/paper/1509.06461/) (2015)
- [Reinforcement learning](https://mlsanity.com/paper/2405.10369/) (2024)
- [On the Road to 6G: Visions, Requirements, Key Technologies and Testbeds](https://mlsanity.com/paper/2302.14536/) (2023)
- [Large Language Model Enhanced Multi-Agent Systems for 6G Communications](https://mlsanity.com/paper/2312.07850/) (2023)
- [Overview of AI and Communication for 6G Network: Fundamentals, Challenges, and Future Research Opportunities](https://mlsanity.com/paper/2412.14538/) (2024)
- [SecureFalcon: Are We There Yet in Automated Software Vulnerability Detection with LLMs?](https://mlsanity.com/paper/2307.06616/) (2023)
- [IRCopilot: Automated Incident Response with Large Language Models](https://mlsanity.com/paper/2505.20945/) (2025)
- [Finding Needles in a Moving Haystack: Prioritizing Alerts with Adversarial Reinforcement Learning](https://mlsanity.com/paper/1906.08805/) (2019)
- [Security and privacy for 6G: A survey on prospective technologies and challenges](https://mlsanity.com/paper/2108.11861/) (2021)
- [Personalized Wireless Federated Learning for Large Language Models](https://mlsanity.com/paper/2404.13238/) (2024)
- [A Survey on Low Latency Towards 5G: RAN, Core Network and Caching Solutions](https://mlsanity.com/paper/1708.02562/) (2017)
- [Edge Learning for 6G-enabled Internet of Things: A Comprehensive Survey of Vulnerabilities, Datasets, and Defenses](https://mlsanity.com/paper/2306.10309/) (2023)
- [LLM-Based Threat Detection and Prevention Framework for IoT Ecosystems](https://mlsanity.com/paper/2505.00240/) (2025)
- [Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence](https://mlsanity.com/paper/2508.10677/) (2025)
- [Optimizing Cyber Defense in Dynamic Active Directories through Reinforcement Learning](https://mlsanity.com/paper/2406.19596/) (2024)
- [Software Security Analysis in 2030 and Beyond: A Research Roadmap](https://mlsanity.com/paper/2409.17844/) (2024)
- [APIRO: A Framework for Automated Security Tools API Recommendation](https://mlsanity.com/paper/2201.07959/) (2022)
- [Zero-Touch Networks: Towards Next-Generation Network Automation](https://mlsanity.com/paper/2312.04159/) (2023)
- [Security Orchestration, Automation, and Response Engine for Deployment of Behavioural Honeypots](https://mlsanity.com/paper/2201.05326/) (2022)
- [Joint Energy Minimization and Resource Allocation in C-RAN with Mobile Cloud](https://mlsanity.com/paper/1509.00374/) (2015)
- [Computation Diversity in Emerging Networking Paradigms](https://mlsanity.com/paper/1701.06008/) (2017)

## Built on by (most cited first, 2 of 2)

- [6G-Bench: An Open Benchmark for Semantic Communication and Network-Level Reasoning with Foundation Models in AI-Native 6G Networks](https://mlsanity.com/paper/2602.08675/) (2026)
- [STAIR: Effective Incident Response Using an End-to-End Agentic Planning Framework](https://mlsanity.com/paper/2608.09524/) (2026)

## Abstract (arXiv)

Zero-Touch Networks (ZTNs) represent a transformative paradigm toward fully automated and intelligent network management, providing the scalability and adaptability required for the complexity of sixth-generation (6G) networks. However, the distributed architecture, high openness, and deep heterogeneity of 6G networks expand the attack surface and pose unprecedented security challenges. To address this, security automation aims to enable intelligent security management across dynamic and complex environments, serving as a key capability for securing 6G ZTNs. Despite its promise, implementing security automation in 6G ZTNs presents two primary challenges: 1) automating the lifecycle from security strategy generation to validation and update under real-world, parallel, and adversarial conditions, and 2) adapting security strategies to evolving threats and dynamic environments. This motivates us to propose SecLoop and SA-GRPO. SecLoop constitutes the first fully automated framework that integrates large language models (LLMs) across the entire lifecycle of security strategy generation, orchestration, response, and feedback, enabling intelligent and adaptive defenses in dynamic network environments, thus tackling the first challenge. Furthermore, we propose SA-GRPO, a novel security-aware group relative policy optimization algorithm that iteratively refines security strategies by contrasting group feedback collected from parallel SecLoop executions, thereby addressing the second challenge. Extensive real-world experiments on five benchmarks, including 11 MITRE ATT&CK processes and over 20 types of attacks, demonstrate the superiority of the proposed SecLoop and SA-GRPO. We will release our platform to the community, facilitating the advancement of security automation towards next generation communications.