四智能体协同的LLM框架，实现实时高效网络防御。
MALCDF: A Distributed Multi-Agent LLM Framework for Real-Time Cyber
- 四类LLM代理分工协作，通过加密语义通信实现联动响应。
- 在50条实时数据流上达90.0%准确率、9.1%误报率，延迟仅6.8秒。
- 适合需要可审计、低误报的实时安全系统部署者参考。
传统集中式安全工具常难以应对自适应、多向量攻击。本文提出多智能体大语言模型网络安全防御框架（MALCDF），由检测、情报、响应和分析四个LLM代理实时协作。各代理通过安全通信层（SCL）传输加密且符合本体对齐的消息，输出可审计结果（如MITRE ATT&CK映射）。评估采用统一的50条记录实时流，源自CICIDS2017特征结构。训练使用部分CICIDS2017数据，测试集与训练集无重叠。实验表明，MALCDF达到90.0%检测准确率、85.7% F1分数、9.1%误报率，平均事件延迟6.8秒。其性能优于轻量级随机森林基线（LRF-IDS）和单个LLM方案，在保持端到端输出一致性的同时提升防御能力。结果表明，通过安全且语义对齐的通信，简单LLM代理协同可有效增强实际实时网络安全防御。
原文摘要 · Abstract (English)
Traditional, centralized security tools often miss adaptive, multi-vector attacks. We present the Multi-Agent LLM Cyber Defense Framework (MALCDF), a practical setup where four large language model (LLM) agents-Detection, Intelligence, Response, and Analysis-work together in real time. Agents communicate over a Secure Communication Layer (SCL) with encrypted, ontology-aligned messages, and produce audit-friendly outputs (e.g., MITRE ATT&CK mappings). For evaluation, we keep the test simple and consistent: all reported metrics come from the same 50-record live stream derived from the CICIDS2017 feature schema. CICIDS2017 is used for configuration (fields/schema) and to train a practical ML baseline. The ML-IDS baseline is a Lightweight Random Forest IDS (LRF-IDS) trained on a subset of CICIDS2017 and tested on the 50-record stream, with no overlap between training and test records. In experiments, MALCDF reaches 90.0% detection accuracy, 85.7% F1-score, and 9.1% false-positive rate, with 6.8s average per-event latency. It outperforms the lightweight ML-IDS baseline and a single-LLM setup on accuracy while keeping end-to-end outputs consistent. Overall, this hands-on build suggests that coordinating simple LLM agents with secure, ontology-aligned messaging can improve practical, real-time cyber defense.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。