---
title: "数字孪生增强的多尺度规划实现智能体事件响应"
source: "arXiv AI/CL/LG（论文）"
source_tier: "t2"
url: "https://arxiv.org/abs/2608.02422v1"
permalink: "https://feed.astralor.com/items/itm_9365c044970146e8b896d6cc"
published: "2026-08-03T16:03:16.000Z"
score: 77
channel: "ai"
tags: ["arXiv","事件响应","大语言模型","数字孪生","智能体","网络安全"]
---

# 数字孪生增强的多尺度规划实现智能体事件响应

## AI 点评

> 这篇论文最值得关注的是把决策理论的严谨性和LLM的灵活性结合起来，不再让模型盲目生成长计划，而是让高层规划和底层执行各司其职。对做安全运营自动化和AI Agent落地的团队来说，这是一个很有参考价值的范式。

## 速览

事件响应目前依赖安全运营者使用预定义剧本，决策过程缓慢且劳动密集。本文提出一种基于LLM的原理性规划方法，将决策理论规划与LLM生成的响应命令结合。方法使用rollout规划器计算高层面响应策略，分配安全资源（战术尺度），再由轻量级LLM代理翻译为可执行命令（操作尺度），并通过数字孪生支持战术模拟与操作仿真。在三个攻击场景中，该方法相比前沿LLM基线平均减少15.1%的恢复执行时间，恢复率提升33.6%。

## 关键点

- 提出结合决策理论规划与LLM命令生成的双尺度Agentic事件响应框架。
- 利用数字孪生衔接战术规划（仿真）与操作执行（模拟）。
- 在三个攻击场景中，恢复执行时间平均减少15.1%，恢复率提升33.6%。

## 全文

Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1\% on average and increases the recovery rate by 33.6\% over frontier LLM baselines.

---

引用前请核对原文;本文由星际流动整理:https://feed.astralor.com/items/itm_9365c044970146e8b896d6cc