智能体
arxiv.org ·
弥合“第一小时”差距：评估执法部门网络事件响应中的人工智能可靠性与基准测试缺陷
该 arXiv 综述系统梳理了辅助网络犯罪一线响应者的决策支持架构，分为 playbook、LLM、RAG 框架和 Agentic AI 系统四类，并考虑一线人员技术能力有限、取证基础设施不一致的现实约束。分析认为 RAG 系统因自然语言适应性是相对可行的中间方案，但提示敏感性和法律语境下的自信幻觉构成主要风险。作者还审查现有网络安全基准，指出其不足以覆盖执法在“第一小时”的安全与法律要求，主张建立聚焦朴素查询鲁棒性与证据保全的新评估基准。
AI推荐理由 arXiv 预印本，作者与摘要信息完整，属系统性综述而非实验验证。核心新信息：将执法部门网络事件响应“第一小时”的决策支持架构分为 playbook、LLM、RAG 与 Agentic AI 四类，并指出 RAG 因自然语言适应性是相对可行的中间方案，但存在提示敏感性与法律场景下自信幻觉的风险；同时论证现有网络安全基准不足以覆盖执法对朴素查询鲁棒性和证据保全的安全与法律要求，呼吁新基准。局限：仅为综述与观点，未提供实测数据或新方法，结论依赖作者分析。
72
正文
Computer Science > Cryptography and Security
arXiv:2609.12681 (cs)
[Submitted on 11 Sep 2026]
Title:Bridging the First-Hour Gap: Evaluating AI Reliability and Benchmarking Deficiencies in Cyber Incident Response for Law Enforcement
Authors:Roshin Sleeba C, Hiran V Nath
View a PDF of the paper titled Bridging the First-Hour Gap: Evaluating AI Reliability and Benchmarking Deficiencies in Cyber Incident Response for Law Enforcement, by Roshin Sleeba C and Hiran V Nath
View PDF
HTML (experimental)
Abstract:The actions of frontline law enforcement officers in the initial hour of a cyber incident play a vital role in determining the ultimate success of an investigation. The minor mistakes they commit might result in irreversible critical impacts. The integrity of the investigation can be compromised, and the prosecution of cyber criminals can be hindered due to minor mistakes that happen in the initial hour. These are mainly because of the volatile nature of digital artifacts that might lead to procedural errors and evidence attrition. This paper provides a systematic survey of decision-support architectures designed to assist first responders of a cybercrime, categorizing them into playbooks, Large Language Models (LLMs), Retrieval-Augmented Generation (RAG) frameworks, and Agentic AI systems. The survey critically considers the constraints of limited technical proficiency and inconsistent forensic infrastructure in a practical scenario. Our analysis identifies RAG-based systems as a relatively viable intermediate solution due to their natural language adaptability. However, significant risk factors like prompt sensitivity and the potential for confident hallucinations in legal contexts pose a major challenge. Furthermore, we review current benchmarks in cybersecurity and demonstrate that they are not sufficient to capture the specific safety and legal requirements of law enforcement, focusing on the initial hour of the cybercrime. We conclude by arguing for the necessity of a new evaluation benchmark focused on naive query robustness and evidence preservation, so as to ensure that AI-driven guidance aligns with the mandatory demands of judicial proceedings.
Subjects:
Cryptography and Security (cs.CR)
Cite as:
arXiv:2609.12681 [cs.CR]
(or
arXiv:2609.12681v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.12681
Focus to learn more
arXiv-issued DOI via DataCite (pending registration)
Submission history
From: Hiran V Nath [view email]
[v1]
Fri, 11 Sep 2026 10:25:28 UTC (120 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled Bridging the First-Hour Gap: Evaluating AI Reliability and Benchmarking Deficiencies in Cyber Incident Response for Law Enforcement, by Roshin Sleeba C and Hiran V Nath
View PDF
HTML (experimental)
TeX Source
view license
Current browse context:
cs.CR
new
|
recent
| 2026-09
Change to browse by:
cs
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)