In-Context Autonomous Network Incident Response: An End-to-End Large Language Model Agent Approach

Paper: 2602.13156 Authors: Yiran Gao, Kim Hammar, Tao Li Categories: cs.CR, cs.AI

Abstract

This paper introduces an end-to-end LLM-based agent for autonomous network incident response that eliminates the need for handcrafted simulators required by traditional reinforcement learning approaches. The agent integrates four core functionalities—perception, reasoning, planning, and action—into a single 14B parameter model. Through fine-tuning and chain-of-thought reasoning, the agent processes raw system logs to infer network states, updates attack model conjectures, simulates response outcomes, and generates effective countermeasures. The system demonstrates in-context adaptation by iteratively refining its understanding through comparison of simulated and actual observations, achieving up to 23% faster recovery times compared to frontier LLMs on real-world incident logs.

Key Contributions

• End-to-end agentic architecture that unifies perception, reasoning, planning, and action in a single lightweight LLM without requiring separate simulators or handcrafted models
• In-context learning mechanism that enables the agent to autonomously adapt its attack conjectures and response strategies by comparing simulated outcomes with actual observations
• Direct log processing capability that preserves semantic information from raw system logs and alerts, avoiding information loss inherent in abstracted state representations
• Practical deployment feasibility with a 14B parameter model that runs on commodity hardware while outperforming larger frontier models by 23% in recovery speed

Methodology and Architecture

The proposed agent architecture integrates four interconnected modules within a single LLM framework. The perception module processes raw system logs and security alerts to construct an understanding of the current network state, leveraging the model’s pre-trained knowledge of system behaviors and attack patterns. Unlike traditional approaches that map logs to discrete state spaces, this module maintains rich semantic information from the original data.

The reasoning module employs chain-of-thought prompting to formulate and update hypotheses about ongoing attacks. By analyzing observed system behaviors and comparing them against known attack patterns, the agent builds a dynamic model of adversary tactics, techniques, and procedures (TTPs). This conjecture is continuously refined as new evidence emerges.

The planning module simulates potential response strategies by projecting their consequences on the inferred network state. Rather than relying on pre-built simulators, the LLM uses its understanding of system dynamics to mentally model how different interventions would affect the attack progression and system recovery.

Finally, the action module generates concrete response commands based on the optimal strategy identified through planning. The agent then observes the actual outcomes of its actions and feeds this information back into the perception-reasoning loop, enabling iterative refinement of its attack model and response strategy.

Experimental Results and Performance

The evaluation uses real-world incident logs documented in cybersecurity literature, providing authentic test cases with known attack patterns and optimal response strategies. The agent demonstrates significant performance advantages over baseline approaches:

Recovery Speed: The proposed agent achieves system recovery up to 23% faster than frontier LLMs when measured from initial detection to full remediation. This improvement stems from more accurate attack model inference and more effective response planning.

Adaptation Capability: Through in-context learning, the agent successfully refines its attack conjectures across multiple iterations. Initial hypotheses based on limited observations are progressively corrected as more evidence accumulates, demonstrating genuine adaptive behavior without requiring retraining.

Resource Efficiency: Operating with only 14B parameters, the agent runs on commodity hardware while maintaining competitive or superior performance compared to much larger models. This efficiency makes the approach practical for deployment in resource-constrained environments.

Semantic Preservation: By processing raw logs directly rather than abstracted state representations, the agent leverages subtle indicators and contextual information that would be lost in traditional state-based approaches, leading to more accurate threat assessment.

Implications and Future Directions

This work represents a paradigm shift in autonomous incident response, moving from simulation-based reinforcement learning to knowledge-driven in-context adaptation. The elimination of handcrafted simulators significantly reduces the engineering effort required for deployment while improving adaptability to novel attack patterns not seen during training.

The success of this approach suggests several promising research directions. First, incorporating multi-modal data sources beyond text logs—such as network traffic patterns, system call traces, and threat intelligence feeds—could further enhance perception accuracy. Second, extending the framework to collaborative multi-agent scenarios where multiple LLM agents coordinate responses across distributed systems presents interesting challenges in communication and consensus.

The demonstrated ability to run effectively on commodity hardware opens possibilities for edge deployment in resource-constrained environments. However, questions remain about the agent’s performance against sophisticated adversarial attacks specifically designed to mislead LLM-based defenders, an area requiring further investigation.

From a broader perspective, this work exemplifies how large language models’ pre-trained knowledge can be leveraged for complex decision-making tasks beyond natural language processing, potentially inspiring similar approaches in other domains requiring autonomous adaptation to dynamic environments.

Takeaways

1. LLM agents can autonomously respond to cyberattacks through in-context learning without requiring handcrafted simulators, achieving 23% faster recovery than frontier models
2. Integrating perception, reasoning, planning, and action into a single 14B parameter model enables practical deployment on commodity hardware
3. Processing raw system logs directly preserves semantic information that improves threat detection compared to abstracted state representations
4. Iterative refinement of attack conjectures through comparison of simulated and actual outcomes demonstrates genuine adaptive capability
5. This approach represents a shift from simulation-based RL to knowledge-driven adaptation, reducing engineering overhead while improving flexibility against novel threats