用大模型做安全响应规划，防幻觉、提效率。
Hallucination-Resistant Security Planning with a Large Language Model
- 让大模型生成方案后，用数字孪生验证一致性，不一致就重来。
- 实验显示恢复时间缩短最高30%，优于前沿大模型。
- 适合需要高可靠性的安全系统设计与运维人员。
大语言模型在安全运维任务（如事件响应规划）中展现出潜力，但其不可靠性和幻觉问题仍是主要挑战。本文提出一种系统性框架，将大模型作为决策支持工具，在迭代循环中生成候选动作，并通过系统约束和前瞻预测检查其一致性。当一致性低时，不采纳该动作，转而通过数字孪生等外部反馈获取信息，并利用上下文学习（ICL）优化候选方案。我们证明该设计可通过调节一致性阈值控制幻觉风险，并在特定假设下建立ICL的后悔界。在基于系统日志生成响应与恢复计划的事件响应场景中，实验在四个公开数据集上表明，本框架可将恢复时间最多缩短30%。
原文摘要 · Abstract (English)
Large language models (LLMs) are promising tools for supporting security management tasks, such as incident response planning. However, their unreliability and tendency to hallucinate remain significant challenges. In this paper, we address these challenges by introducing a principled framework for using an LLM as decision support in security management. Our framework integrates the LLM in an iterative loop where it generates candidate actions that are checked for consistency with system constraints and lookahead predictions. When consistency is low, we abstain from the generated actions and instead collect external feedback, e.g., by evaluating actions in a digital twin. This feedback is then used to refine the candidate actions through in-context learning (ICL). We prove that this design allows to control the hallucination risk by tuning the consistency threshold. Moreover, we establish a bound on the regret of ICL under certain assumptions. To evaluate our framework, we apply it to an incident response use case where the goal is to generate a response and recovery plan based on system logs. Experiments on four public datasets show that our framework reduces recovery times by up to 30% compared to frontier LLMs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。