论文研究
arxiv.org ·
基于规则引擎与本地大语言模型的受控告警后事件编排与响应子系统设计与评估
该论文面向教育信息系统，设计受控的告警后事件编排与响应子系统，将确定性分类、上下文分析、人工审批与技术执行分层：规则引擎判定严重度并选择 playbook，静态 RAG 与本地大语言模型在 Validator、Guardrail、Output Sanitizer 和 Safe Fallback 控制下提供建议内容。实验在模拟告警写入 Elasticsearch 后开展：规则引擎在全部 30 个边界用例中与预设路由矩阵一致；持久队列完成 100 个事件，无重复任务、无新增失败任务、无意外防火墙规则；8 告警争用实验保持单活跃模型请求上限；30 次顺序测量显示平均告警后处理时间约 33 秒。作者称结果在实验室评估范围内展示了功能正确性、可追溯性、受控恢复和有界模型集成。
AI推荐理由 arXiv 安全方向论文，提出规则引擎+本地 LLM 的受控告警后事件编排与响应子系统，架构上把确定性分类、上下文分析、人工审批和技术执行分离，并用 Validator、Guardrail、Output Sanitizer、Safe Fallback 约束模型输出。实验在模拟告警写入 Elasticsearch 后进行：规则引擎在 30 个边界用例中与预设路由矩阵一致，持久队列完成 100 个事件且无重复任务、无新增失败任务、无意外防火墙规则，8 告警争用实验保持单模型请求上限，30 次顺序测量平均后处理时间约 33 秒。局限是实验室范围、模拟告警、样本量小，未涉及真实生产环境或安全效果验证。对做安全编排、Agent 受控落地和本地模型集成有参考价值，但属小规模工程评估，非突破性成果。
62
正文
Computer Science > Cryptography and Security
arXiv:2609.26316 (cs)
[Submitted on 22 Sep 2026]
Title:Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model
Authors:Hoang-Lam Huynh, Quoc-Cuong Tang, Van-Tri Phan, Khuong Nguyen-An
View a PDF of the paper titled Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model, by Hoang-Lam Huynh and 3 other authors
View PDF
HTML (experimental)
Abstract:This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the playbook, while Static RAG and a local large language model provide advisory content under Validator, Guardrail, Output Sanitizer, and Safe Fallback controls. Experiments begin after simulated alerts are stored in Elasticsearch. The Rule Engine matched the predefined routing matrix in all 30 boundary cases. The Durable Queue completed 100 events without duplicate tasks, new failed tasks, or unintended firewall rules. An eight-alert contention experiment preserved the configured limit of one active model request, and 30 sequential measurements showed an overall mean post-alert processing time of approximately 33 seconds. The results demonstrate functional correctness, traceability, controlled recovery, and bounded model integration within the evaluated laboratory scope.
Comments:
Subjects:
Cryptography and Security (cs.CR); Software Engineering (cs.SE)
ACM classes:
C.2.0; C.2.3; I.2.6
Cite as:
arXiv:2609.26316 [cs.CR]
(or
arXiv:2609.26316v1 [cs.CR] for this version)
https://doi.org/10.48550/arXiv.2609.26316
Focus to learn more
arXiv-issued DOI via DataCite (pending registration)
Submission history
From: Khuong Nguyen-An [view email]
[v1]
Tue, 22 Sep 2026 12:26:15 UTC (4,640 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model, by Hoang-Lam Huynh and 3 other authors
View PDF
HTML (experimental)
TeX Source
view license
Current browse context:
cs.CR
new
|
recent
| 2026-09
Change to browse by:
cs
cs.SE
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)