SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
[Kryptografia i bezpieczeństwo] Autorzy: Uday Vallabhaneni, Cassie L. Cagwin, David J. Wild
Large language model (LLM) agents are increasingly proposed as autonomous SOC analysts, but two limitations make them unreliable at enterprise scale: a finite context window cannot hold a multi-thousand-host authentication graph, and free-form generation offers no guarantee that a recommended containment action is consistent with the topology it operates on. We present Sentinel-RL, an agentic-SOC architecture that decouples topological reasoning from semantic reasoning: a heterogeneous graph attention encoder summarizes the live authentication subgraph into a fixed-dimensional state, a Proximal Policy Optimization (PPO) policy maps this state to a constrained set of investigative actions, and an LLM agent loop is restricted to consuming the policy's recommendations and producing analyst-readable narratives gated by a critic. We instantiate the system on the LANL Comprehensive, Multi-Sou…
- Kategoria arxiv
- cs.CR
- Kategoria
- Kryptografia i bezpieczeństwo