用多智能体自动调查网络安全风险，减少人工干预。
LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance
- 构建多智能体系统，融合规则与自主推理完成全流程调查。
- 端到端工具调用成功率97.8%，风险判断准确率95%。
- 适合安全运营中心应对复杂攻击，降低人力负担。
快速演进的复杂网络攻击已使传统依赖规则或签名的现代安全运营中心（SOC）不堪重负。这些遗留框架常产生大量缺乏组织上下文的技术告警，导致分析员疲劳和响应延迟。本文提出LiaisonAgent，一个基于QWQ-32B大模型的自治多智能体系统，旨在弥合技术风险检测与业务级风险治理之间的差距。系统集成人机交互、综合判断与自动化处置三类子智能体，执行端到端调查流程。采用混合规划架构，结合确定性工作流与基于ReAct范式的自主推理，以应对模糊操作场景。在大规模数据外泄和未经授权账户借用等多样安全情境下的实验评估显示，系统端到端工具调用成功率达97.8%，风险判断准确率为95%。此外，系统对分布外噪声和对抗性提示注入表现出显著鲁棒性，同时将人工调查开销降低92.7%。
原文摘要 · Abstract (English)
The rapid evolution of sophisticated cyberattacks has strained modern Security Operations Centers (SOC), which traditionally rely on rule-based or signature-driven detection systems. These legacy frameworks often generate high volumes of technical alerts that lack organizational context, leading to analyst fatigue and delayed incident responses. This paper presents LiaisonAgent, an autonomous multi-agent system designed to bridge the gap between technical risk detection and business-level risk governance. Built upon the QWQ-32B large reasoning model, LiaisonAgent integrates specialized sub-agents, including human-computer interaction agents, comprehensive judgment agents, and automated disposal agents-to execute end-to-end investigation workflows. The system leverages a hybrid planning architecture that combines deterministic workflows for compliance with autonomous reasoning based on the ReAct paradigm to handle ambiguous operational scenarios. Experimental evaluations across diverse security contexts, such as large-scale data exfiltration and unauthorized account borrowing, achieve an end-to-end tool-calling success rate of 97.8% and a risk judgment accuracy of 95%. Furthermore, the system exhibits significant resilience against out-of-distribution noise and adversarial prompt injections, while achieving a 92.7% reduction in manual investigation overhead.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。