Paper deep dive
Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack Inference
Yiran Gao, Juntao Chen, Tao Li
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 93%
Last extracted: 8/18/2026, 5:11:31 AM
Summary
The paper presents a hierarchical agentic incident response framework that integrates Large Language Model (LLM) agents with digital twin validation to automate network defense. The system uses a fine-tuned inference agent to reconstruct multi-stage attacks from partial observations, which are then calibrated via an emulated network digital twin. A rollout planner prioritizes affected components at the tactical layer, while a planning agent and execution agent handle operational recovery actions and command generation, validated in the digital twin. The framework was evaluated on a 33-component enterprise network testbed, demonstrating an 18-31% improvement in recovery success rate over frontier LLM baselines.
Entities (10)
Relation Signals (9)
Hierarchical Agentic Incident Response Framework → outperforms → frontier-LLM baselines
confidence 96% · The results show that our framework outperforms frontier-LLM baselines in recovery success rate by 18--31%.
Hierarchical Agentic Incident Response Framework → evaluatedon → Enterprise-Network Testbed
confidence 95% · We evaluate the framework on a 33-component enterprise-network testbed
Hierarchical Agentic Incident Response Framework → uses → Inference Agent
confidence 95% · A fine-tuned LLM infers the attack progression and affected hosts from security alerts and system measurements.
Inference Agent → validateswith → Digital Twin
confidence 94% · An emulated network digital twin replays the inferred attack and returns discrepancies between predicted and observed effects to calibrate the inference.
Hierarchical Agentic Incident Response Framework → uses → Planning Agent
confidence 93% · At the operational layer, the planning agent proposes high-level recovery actions
Hierarchical Agentic Incident Response Framework → uses → Execution Agent
confidence 93% · an execution agent translates selected actions into recovery and verification commands that are validated in the digital twin.
Hierarchical Agentic Incident Response Framework → uses → Rollout Planner
confidence 93% · A separately fine-tuned planning agent uses the rollout planning method to prioritize affected components at the tactical layer.
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Network incident response remains slow and labor-intensive as the defender must infer multi-stage attacks from partial observations and translate recovery decisions into reliable system commands. Decision-theoretic planners provide principled optimization but typically rely on abstract states and predefined actions, while large language model (LLM) agents can reason over operational context but may hallucinate attacks and responses. Toward automating response planning, we present a hierarchical agentic response framework that integrates LLM-based attack inference, rollout planning, and digital-twin validation. A fine-tuned LLM infers the attack progression and affected hosts from security alerts and system measurements. An emulated network digital twin replays the inferred attack and returns discrepancies between predicted and observed effects to calibrate the inference. A separately fine-tuned planning agent uses the rollout planning method to prioritize affected components at the tactical layer. At the operational layer, the planning agent proposes high-level recovery actions, and an execution agent translates selected actions into recovery and verification commands that are validated in the digital twin. We evaluate the framework on a 33-component enterprise-network testbed under three multi-stage attack scenarios. The results show that our framework outperforms frontier-LLM baselines in recovery success rate by 18--31%.
Tags
Links
- Source: https://arxiv.org/abs/2608.15016v1
- Canonical: https://arxiv.org/abs/2608.15016v1
Trouble viewing inline? Open PDF directly →
Full Text
37,944 characters extracted from source content.
Expand or collapse full text
Hierarchical Agentic Incident Response with Digital-Twin-Validated Attack InferenceThanks: Yiran Gao and Tao Li are supported by CityU internal grant No. 9610792. †Corresponding author: Tao Li. Yiran Gao Affiliation: Department of Systems Engineering, City University of Hong Kong,Hong Kong SAR, 99977, Emails: gaoyiran525@gmail.com, li.tao@cityu.edu.hk Juntao Chen Affiliation: Department of Computer and Information Sciences, Fordham University,New York, NY, 10023, USA, Email: jchen504@fordham.edu Tao Li Affiliation: Department of Systems Engineering, City University of Hong Kong,Hong Kong SAR, 99977, Emails: gaoyiran525@gmail.com, li.tao@cityu.edu.hk Abstract Network incident response remains slow and labor-intensive as the defender must infer multi-stage attacks from partial observations and translate recovery decisions into reliable system commands. Decision-theoretic planners provide principled optimization but typically rely on abstract states and predefined actions, while large language model (LLM) agents can reason over operational context but may hallucinate attacks and responses. Toward automating response planning, we present a hierarchical agentic response framework that integrates LLM-based attack inference, rollout planning, and digital-twin validation. A fine-tuned LLM infers the attack progression and affected hosts from security alerts and system measurements. An emulated network digital twin replays the inferred attack and returns discrepancies between predicted and observed effects to calibrate the inference. A separately fine-tuned planning agent uses the rollout planning method to prioritize affected components at the tactical layer. At the operational layer, the planning agent proposes high-level recovery actions, and an execution agent translates selected actions into recovery and verification commands that are validated in the digital twin. We evaluate the framework on a 33-component enterprise-network testbed under three multi-stage attack scenarios. The results show that our framework outperforms frontier-LLM baselines in recovery success rate by 18–31%. I Introduction Network incident response encompasses the analysis, containment, eradication, and recovery activities that follow an intrusion. Current practice relies heavily on human operators, who must interpret fragmented evidence and translate decisions into specific operations. These labor-intensive tasks are difficult to scale amid the persistent shortage of cybersecurity professionals. Autonomous cyber defense (ACD) [20] has therefore emerged as a promising approach in which security analysis and response are delegated to intelligent agents. Decision-theoretic approaches to ACD use control and optimization, game theory, and reinforcement learning (RL) for response planning [16]. They provide principled security decision-making through abstract models, including Markov decision processes (MDPs) and security games [15]. However, they typically assume access to abstract security states and predefined defensive actions and are not designed to reconstruct concrete multi-stage attacks from partial observations or translate tactical decisions into executable recovery actions. LLM agents offer a promising way to close this gap because they can interpret system context and security observations and generate system-specific response guidance and commands [17]. Recent works use prompt-based reasoning or multi-agent orchestration to select defensive actions and decompose incident-response tasks [18, 17]. Although these prior works include planning components, they generally rely on prompted reasoning rather than decision-theoretic sequential optimization. Consequently, their outputs can be sensitive to prompt design and available context, while hallucination remains an important concern [6]. To bridge attack inference, tactical recovery planning, and operational execution, we develop a hierarchical response framework that integrates LLM agents, rollout planning, and digital-twin emulation. As shown in Fig. 1, a fine-tuned inference agent first reconstructs the sequence of core attack actions and their target hosts from system context and IDS observations. The digital twin then replays the inferred attack sequence and returns discrepancies between its observable effects and the incident observations to calibrate the inference. At the tactical layer, a lookahead rollout planner [14] uses an abstract recovery-state model to prioritize affected components. At the operational layer, a fine-tuned planning agent proposes candidate high-level recovery actions for the prioritized component, and an execution agent translates each action into recovery and verification commands. Candidate actions are selected using Monte Carlo estimates of digital-twin-verified recovery costs. Inference agentRollout planner(tactical level)Planning agent(operational level)Execution agent(operational level)Digital twinAttack replayRecovery verification>_SystemmeasurementsRecoverycommandsRecoveryPriorityUpdatedSecurityStateVerificationCost EmulationInferenceCalibration Fig. 1: Overview of the hierarchical agentic incident-response framework. We implement and evaluate the proposed framework on a containerized enterprise-network testbed comprising 33 interconnected components across multiple subnets. The environment includes multi-homed hosts, heterogeneous services with diverse vulnerabilities, IDS monitoring points, and attack paths requiring lateral movement across network segments. We consider three multi-stage attack scenarios with increasing attacker capability and attack-path complexity. Across these scenarios, our framework outperforms frontier-LLM baselines in recovery success rate by 18–31 percentage points. Our contributions are summarized as follows. • We propose a hierarchical incident-response framework that integrates attack inference with tactical and operational recovery planning. At the tactical layer, decision-theoretic rollout prioritizes affected components across the network. At the operational layer, LLM agents propose component-specific recovery actions and translate the selected actions into executable commands. • We ground both attack inference and recovery planning in a network digital twin. Inferred attack sequences are replayed and calibrated using discrepancies in their observable effects, while generated recovery commands undergo emulation-based verification. • We implement the framework using locally deployed lightweight LLM agents and evaluate it on a 33-component, segmented enterprise-network testbed under three multi-stage attack scenarios. The framework outperforms frontier-LLM baselines in recovery success rate by 18–31 percentage points. I Related Work Decision-theoretic incident response. Incident response is naturally a sequential decision-making problem in which states represent the network security posture and actions represent defensive responses. Recent studies have investigated online, meta, and multi-agent learning for adaptive defense [7, 8, 3, 12]. RL further enables data-driven planning when an explicit transition model is unavailable [16]. However, training and evaluating RL agents typically require a sufficiently faithful simulator or testbed, since extensive exploration on an operational network is unsafe and costly. LLM-based incident response. LLMs offer a more operational alternative to decision-theoretic response methods by interpreting security observations and generating context-specific recovery actions. Existing approaches include prompt-based LLM orchestration [18, 17], which typically does not perform explicit sequential optimization and can be sensitive to prompt design. Recent work combines decision-theoretic planning with LLM generation by using rollout or Monte Carlo tree search [6, 1]. Cyber digital twins. Digital twins originated as digital replicas of physical systems that operate alongside their real-world counterparts to support situational awareness and decision making [4, 13, 11]. In cybersecurity, digital twins can support high-fidelity emulation that reproduces operational system behavior in a controlled environment, enabling forensic analysis, vulnerability assessment, and the execution and validation of security operations before deployment [19]. Novelty of our approach. Unlike methods that assume the incident and affected assets are known, our framework uses a fine-tuned LLM to infer core attack actions and target hosts from system context and IDS observations and executes the inferred attack in a digital twin, thereby calibrating the inference against observable compromise effects. Compared with the most closely related approaches [6, 1], our framework integrates decision-theoretic tactical planning, LLM-generated operational recovery actions, and digital-twin validation in a single hierarchy. This design combines abstract-model rollout for efficient tactical planning with digital-twin emulation for attack replay and operational recovery verification. I Formalizing Incident Response Planning We formulate incident response at two levels: (i) tactical planning, which prioritizes affected components for recovery, and (i) operational planning, which selects recovery actions for a chosen component. For cross-level planning, we consider a factorized partially observable Markov decision process, in which the system state factors into network-level security posture and component-level recovery states. System States, Observations, and Beliefs. We represent the affected system by a graph =(,ℰ)G=(V,E), where =1,…,NV=\1,…,N\ is the set of system components and ℰE captures their communication or dependency relationships. The system operator, henceforth the defender, monitors these components through intrusion-detection alerts, logs, and service measurements, which are referred to as partial observations. We define the global security state as an N-dimensional Boolean vector gt=(gt1,…,gtN),gtk∈0,1,g_t=(g_t^1,…,g_t^N),g_t^k∈\0,1\, where gtk=1g_t^k=1 indicates that component k is compromised, while gtk=0g_t^k=0 indicates that it is safe. Each component k also has a local recovery state ℓtk=(ℓtk(c),ℓtk(a),ℓtk(p),ℓtk(e),ℓtk(h),ℓtk(r))∈0,16, _t^k=( _t^k(c), _t^k(a), _t^k(p), _t^k(e), _t^k(h), _t^k(r))∈\0,1\^6, whose entries record completion of the six response stages [10]: 1) attack containment, 2) attack assessment, 3) forensic preservation, 4) attack eviction, 5) network hardening, and 6) service restoration. For example, ℓtk(c)=1 _t^k(c)=1 means that the attack on component k has been contained. The terminal local state is ℓR=(1,1,1,1,1,1) _R=(1,1,1,1,1,1). For a component that is initially safe, we set its local state to ℓR _R. The joint system state across the two levels is st=((gtk,ℓtk)k∈[N])s_t=((g_t^k, _t^k)_k∈[N]), [N]≔1,…,N[N] \1,…,N\. While the true system state remains hidden from the defender, the defender receives an observation oto_t that includes IDS alerts and system measurements and is correlated with sts_t. Based on the historical observations o0:to_0:t, the defender forms a state belief bt(s)=Pr(st=s∣o0:t)b_t(s)= (s_t=s o_0:t). Following the state factorization across the global and local levels, we represent btb_t by a global belief btg∈[0,1]Nb_t^g∈[0,1]^N and local beliefs btk∈[0,1]6b_t^k∈[0,1]^6 for k∈[N]k∈[N]. Here, btg(k)b_t^g(k) is the probability that component k is safe, and btk(i)b_t^k(i) is the probability that its iith response stage is complete. These beliefs are based on the assumption that recovery progress across components is independent, thereby reducing the dimensionality of the belief space. Hierarchical Action and Cost. A response action is the pair at=(atg,atℓ)a_t=(a_t^g,a_t ). The tactical action atga_t^g is a permutation of [N][N] that specifies the response priority of each component, where atg(k)a_t^g(k) is the priority rank of component k. For a global state g, let (g)=j∈[N]:gj=1U(g)=\j∈[N]:g^j=1\ denote the set of compromised components that have not yet been recovered. Denote by k the highest-priority component in (g)U(g) under priority order aga^g. The operational action atℓa_t is the high-level recovery action applied to the selected component. Let τ(ℓtk,atℓ)τ( _t^k,a_t ) denote the wall-clock time for completing atℓa_t on component k when its local state is ℓtk _t^k. During this interval, component k incurs its own execution time, while every other unrecovered component incurs the same amount of delay. We therefore define the unweighted aggregate recovery-delay cost as c(st,at)=|(gt)|τ(ℓtk,atℓ).c(s_t,a_t)= (g_t) τ( _t^k,a_t ). System Transition. Let θ∈Θθ∈ denote the attack-action sequence executed during an incident, where Θ denotes the set of admissible attack sequences. Specifically, define the actual attack sequence as θ=((u1,v1),…,(ud,vd)),θ=((u_1,v_1),…,(u_d,v_d)), where d is the number of attack steps, uju_j is the core attack action at step j, and vj∈v_j is its target component. The attack sequence influences the component-level recovery dynamics. Let ℓt=(ℓt1,…,ℓtN) _t=( _t^1,…, _t^N) collect the local recovery states, and let k be the component selected by the tactical action. Because the operational action is applied only to component k, the local transition is Pθℓ(ℓt+1∣ℓt,at)=Pθk(ℓt+1k∣ℓtk,atℓ)∏j≠kℓt+1j=ℓtj,P_θ ( _t+1 _t,a_t)=P_θ^k( _t+1^k _t^k,a_t ) _j≠ k 1\ _t+1^j= _t^j\, where PθkP_θ^k describes the progress of component k through the response stages. The realized local states then drive the global transition: Pθ(st+1∣st,at)=Pθℓ(ℓt+1∣ℓt,at)Pg(gt+1∣gt,ℓt+1).P_θ(s_t+1 s_t,a_t)=P_θ ( _t+1 _t,a_t)P^g(g_t+1 g_t, _t+1). Since gtjg_t^j records only whether component j remains compromised, its update is deterministic: Pg(gt+1∣gt,ℓt+1)=∏j=1Ngt+1j=gtjℓt+1j≠ℓR.P^g(g_t+1 g_t, _t+1)= _j=1^N 1\! \g_t+1^j=g_t^j 1\ _t+1^j≠ _R\ \. Thus, a safe component remains safe, whereas a compromised component becomes safe exactly when its local state reaches complete recovery. The complete-recovery state is sR=((0,ℓR)j∈[N])s_R=((0, _R)_j∈[N]) and is absorbing: Pθ(sR∣sR,a)=1P_θ(s_R s_R,a)=1 for every response action. Planning objective. A response policy π maps the current belief to a hierarchical response action, i.e., at∼π(⋅∣bt)a_t π(· b_t). The defender seeks a response policy π that minimizes the expected cumulative recovery cost over a finite horizon H under the transition model induced by the inferred attack sequence: minπPθ,π[∑t=0Hc(st,at)]. _π\;E_P_θ,π\! [ _t=0^Hc(s_t,a_t) ]. (1) The expectation accounts for the uncertainty in both the partially observed recovery state and its evolution under the response policy. The next section develops a hierarchical planning method that approximates this objective across the tactical and operational levels. IV Hierarchical Planning in Agentic Response Our method consists of an offline fine-tuning stage and an online hierarchical response stage. In the offline stage, we fine-tune two variants of a lightweight local model, DeepSeek-R1-Distill-Qwen-14B [5], on three instruction-response tasks. The first variant, referred to as the inference agent, is trained on incident examples and aims to infer the attack sequence θ. The second variant, called the planning agent, is tasked with generating beliefs and actions. In the online stage, the inference agent reconstructs and calibrates the attack sequence, after which tactical rollout prioritizes the affected components and the planning agent generates high-level recovery actions. Finally, an execution agent, powered by Qwen3.6-27B, translates selected high-level recovery actions into executable recovery and verification commands, which are validated in the digital twin. IV-A Offline Fine-Tuning We fine-tune the DeepSeek model, denoted by Φw _w, using low-rank adaptation (LoRA) on an open-source corpus of approximately 68,00068,000 security incidents and corresponding responses, as in the previous work [2]. Let =(i,i)i=1KD=\(x^i,y^i)\_i=1^K denote the resulting instruction–response dataset, where ix^i contains the task instruction and incident context and i=(y1i,…,yLii)y^i=(y_1^i,…,y_L_i^i) is the target output sequence. We optimize the trainable model parameters w using the autoregressive cross-entropy objective ℒ(w)=−1B∑i=1B∑n=1LilogΦw(yni∣i,y1:n−1i),L(w)=- 1B _i=1^B _n=1^L_i _w\! (y_n^i ^i,y_1:n-1^i ), (2) where B is the mini-batch size, LiL_i is the number of target tokens in training example i, and Φw(yni∣i,y1:n−1i) _w(y_n^i ^i,y_1:n-1^i) denotes the model’s conditional probability of target token yniy_n^i. Under task-specific instructions, the fine-tuned model performs three functions for use in the online procedure. 1) For the attack inference tasks (inference agent), the task instruction x includes the incident description and IDS alerts, while the response y contains the corresponding MITRE ATT&CK tactics and techniques, as well as attack sequences. 2) For state prediction (planning agent), the task instruction x remains the same, while the response contains the labeled state sts_t and its supporting evidence summary mtm_t. During deployment, we sample multiple state predictions and use their empirical frequencies to construct the belief btb_t. 3) For action generation (planning agent), the instruction x is further augmented with the belief btb_t, evidence summary mtm_t, and previous response action at−1a_t-1, while the response contains the next recovery action recorded in the training dataset. In summary, we obtain two model weights, wIw_I and wPw_P, for the two agents, respectively. IV-B Digital Twin-Based Attack Inference and Calibration The online stage unfolds as follows. The defender first invokes the inference agent, ΦwI _w_I, to estimate the unknown attack sequence θ by inspecting the available partial observations o0o_0, including system context, IDS alerts, logs, and service measurements. The conjecture θ θ is then executed in a network digital twin that replicates the affected system to produce an emulated observation o^0 o_0. We deem o^0 o_0 and o0o_0 consistent when they agree on the affected hosts, privilege and service states, backdoor indicators, IDS alerts, and attack-path reachability. If they are consistent, the inferred attack sequence is accepted for response planning. Otherwise, the observed discrepancies are returned to the inference agent, which revises the attack sequence before response planning begins. Calibration can repeat until the observations are consistent or a preset iteration limit is reached. In our experiments, we allow one revision because it already provides a satisfactory improvement in attack-inference accuracy, as shown in Table I. IV-C Tactical Rollout Planning The inferred attack sequence identifies the affected components and induces an estimated global transition model Pθ^g(gt+1∣gt,atg)P_ θ^g(g_t+1 g_t,a_t^g) for tactical planning. At each tactical step, the priority order atga_t^g selects the highest-priority unrecovered component. The model assumes that this component is fully recovered through a sequence of operational actions before the next tactical decision, while the global states of the other components remain unchanged. At recovery step t, the tactical planner constructs a candidate set tgA_t^g of component-priority permutations and evaluates which component should be recovered next. For each candidate priority order a~g a^g, let k denote the highest-priority component in (g)U(g). Let τ^tk τ_t^k denote the estimated duration of recovering component k, computed from previously completed local recoveries when available and initialized using an offline average otherwise. Recovering k delays every other unrecovered component by this duration. We therefore define the unweighted tactical delay cost as c^g(g,a~g)=|(g)∖k|τ^tk. c^g(g, a^g)= (g) \k\ τ_t^k. The planner samples MgM_g possible global states g^tii=1Mg\ g_t^i\_i=1^M_g from the global belief btgb_t^g and simulates each candidate for HgH_g lookahead steps. Its estimated rollout cost is given by Jg(a~g)=1Mg∑i=1Mg∑h=0Hgc^g(g^t+hi,a~g),J_g( a^g)= 1M_g _i=1^M_g _h=0^H_g c^g( g_t+h^i, a^g), (3) where g^t+h+1i∼Pθ^g(⋅∣g^t+hi,a~g) g_t+h+1^i P_ θ^g(· g_t+h^i, a^g) for h=0,…,Hg−1h=0,…,H_g-1. The selected tactical action is atg∈argmina~g∈tgJg(a~g).a_t^g∈ _ a^g _t^gJ_g( a^g). Since enumerating all N!N! priority orders is intractable for large networks, the initial order ranks components by decreasing compromise probability 1−b0g(k)1-b_0^g(k). At subsequent recovery steps, tgA_t^g is restricted to the priority orders obtained by permuting up to the three highest-priority unrecovered components in the previous order. Under the selected priority order atga_t^g, let k denote the highest-priority unrecovered component. This component is passed to operational planning. IV-D Operational Planning and Command Validation Let k denote the component selected by the tactical priority order atga_t^g. Conditioned on the current belief btb_t, its supporting evidence summary mtm_t, and the previous local action, the planning agent generates a set of candidate high-level recovery actions tℓ=a^t1,…,a^tNℓA_t =\ a_t^1,…, a_t^N_ \. For each candidate a^ti a_t^i, the model generates MℓM_ rollout trajectories ζi,rr=1Mℓ\ζ^i,r\_r=1^M_ , each beginning with a^ti a_t^i and continuing until the local terminal state ℓR _R or the rollout-depth limit. Every high-level action a a in a trajectory is translated by the execution agent into a command plan q(a^)=((a^),(a^))q( a)=(C( a),Q( a)), where (a^)C( a) and (a^)Q( a) contain the recovery and verification commands, respectively. The first validation stage checks whether the recovery and verification commands are compatible with the available containers, files, services, interfaces, and network paths. The second stage executes the plan in the emulated digital twin and verifies whether it produces the intended recovery-state transition. We define the verified operational cost as cDT(a^)=TimeDT(q(a^)),if both validation stages pass,∞,otherwise,c_DT( a)= casesTime_DT(q( a)),&if both validation stages pass,\\ ∞,&otherwise, cases where TimeDTTime_DT is the wall-clock time required to execute the recovery and verification commands in the digital twin. Command generation, compatibility checking, and checkpoint restoration are measured separately as planning overhead. All candidate rollouts begin from the same restored digital-twin checkpoint, ensuring that their costs are comparable, while actions within each rollout are executed sequentially. After all candidates are evaluated, the digital twin is restored once more to the pre-decision checkpoint before the selected command plan is executed. A candidate is considered feasible only if every command plan in all of its sampled trajectories passes both validation stages; otherwise, its estimated cost is set to infinity. The Monte Carlo estimate of the remaining operational recovery cost and the associated best response are, respectively, given by Q(bt,a^ti)=1Mℓ∑r=1Mℓ∑a^∈ζi,rcDT(a^),atℓ∈argmina^ti∈tℓQ(bt,a^ti).Q(b_t, a_t^i)= 1M_ _r=1^M_ _ a∈ζ^i,rc_DT( a), a_t ∈ _ a_t^i _t Q(b_t, a_t^i). If every candidate has infinite cost, no operational action is committed, and the planning attempt is declared unsuccessful. Otherwise, the command plan for the selected action atℓa_t is executed in the digital twin. The resulting recovery observation ot+1o_t+1, together with the current belief, evidence summary, and response action, is then returned to the planning agent. Multiple updated state predictions are sampled to construct bt+1b_t+1 from their empirical frequencies and update the supporting evidence summary mt+1m_t+1. This generate–rollout–validate–execute cycle continues until the local state of component k reaches ℓR _R and the component is marked safe, after which tactical planning selects the next component. TABLE I: Core attack actions in the three evaluation scenarios. Scenario Core attack actions Novice TELNET_SAME_USER_PASS_DICTIONARY, FTP_SAME_USER_PASS_DICTIONARY, SHELLSHOCK_EXPLOIT, SSH_SAME_USER_PASS_DICTIONARY, CVE_2010_0426_PRIV_ESC Experienced SAMBACRY_EXPLOIT, SSH_SAME_USER_PASS_DICTIONARY, CVE_2010_0426_PRIV_ESC, DVWA_SQL_INJECTION, CVE_2015_1427_EXPLOIT Expert SAMBACRY_EXPLOIT (edge Samba), DVWA_SQL_INJECTION, CVE_2015_1427_EXPLOIT, SAMBACRY_EXPLOIT (deep internal Samba) V Experimental Evaluation We evaluate the end-to-end recovery performance of the proposed framework using recovery time and recovery rate. The training-data construction, fine-tuning procedure, and standalone evaluation of the local DeepSeek-R1-Distill-Qwen-14B model are reported in our previous work [2]; hence, we do not repeat the model-level evaluation here because of space limitations. V-A Experimental Setup Digital-twin environment. We conduct the experiments on a containerized enterprise network digital twin comprising approximately 33 interconnected components distributed across multiple subnets, adapted from [9]. The environment includes multi-homed hosts, heterogeneous vulnerable services, routing components, and IDS monitoring points. This topology, as shown in Fig. 2, supports attack paths that cross network segments and therefore requires the response planner to reason about affected components and their network dependencies. Fig. 2: Enterprise-network digital-twin topology. Attack scenarios. We consider three multi-stage attack scenarios, denoted novice, experienced, and expert. The scenarios represent increasing attacker capability and attack-path complexity, ranging from a comparatively short compromise path to attacks involving additional exploitation and lateral movement across multi-homed components. Table I summarizes the core attack actions in each scenario. Implementation. The local inference model is DeepSeek-R1-Distill-Qwen-14B with the fine-tuned adapter described in [2]. We use the same four-dataset LoRA fine-tuning configuration as in [2]. At each operational decision step, the model proposes two candidate high-level recovery actions, with two Monte Carlo rollouts per candidate. The execution agent translates semantic actions into component-specific recovery and verification commands, which are validated and executed in the digital twin. All experiments are performed on a Google Cloud virtual-machine instance equipped with one NVIDIA A100 GPU with 40 GB of memory. V-B Metrics and Baselines Core attack-action accuracy. We first evaluate whether the fine-tuned LLM can infer the core attack actions used in each multi-stage attack. For each scenario, we generate 20 predictions from the same system description and IDS observations, normalize each into an attack-action set, and compare it with the reference set. Per-action accuracy is the fraction of predictions containing a given ground-truth action. Let True Positive (TP) denote correctly inferred attack actions, False Positive (FP) denote inferred actions that are not in the reference attack, and False Negative (FN) denote reference attack actions missed by the model. Following the class-agnostic evaluation used in our prior work, we aggregate TP, FP, and FN over all repeated predictions before computing precision, recall, and F1. They are computed as Precision=TP/(TP+FP)Precision=TP/(TP+FP), Recall=TP/(TP+FN)Recall=TP/(TP+FN), and F1=2⋅Precision⋅Recall/(Precision+Recall)F1=2·Precision·Recall/(Precision+Recall). TABLE I: Per-action attack inference accuracy across scenarios before and after calibration. Novice Pre-Calibration Post-Calibration SSH_SAME_USER_PASS_DICTIONARY 50% 55% TELNET_SAME_USER_PASS_DICTIONARY 60% 70% FTP_SAME_USER_PASS_DICTIONARY 25% 55% SHELLSHOCK_EXPLOIT 40% 45% CVE_2010_0426_PRIV_ESC 75% 75% Experienced Pre-Calibration Post-Calibration SAMBACRY_EXPLOIT 95% 95% SSH_SAME_USER_PASS_DICTIONARY 90% 95% CVE_2010_0426_PRIV_ESC 15% 65% DVWA_SQL_INJECTION 90% 90% CVE_2015_1427_EXPLOIT 90% 90% Expert Pre-Calibration Post-Calibration SAMBACRY_EXPLOIT (edge Samba) 100% 100% DVWA_SQL_INJECTION 100% 100% CVE_2015_1427_EXPLOIT 100% 100% SAMBACRY_EXPLOIT (deep internal Samba) 100% 100% TABLE I: Scenario-level precision, recall, and F1 scores for attack-action inference. Scenario Novice Experienced Expert (P, R, F1; %) (78.1, 50.0, 61.0) (98.7, 76.0, 85.9) (88.9, 100.0, 94.1) Recovery success and recovery time. We then evaluate the recovery stage using recovery success rate, planning time, and operational execution time. A trial is successful only if the selected recovery sequence reaches the terminal six-stage recovery state and the corresponding operational commands pass digital-twin validation. Planning time includes high-level action generation, rollout evaluation, command generation and validation, and digital-twin state restoration. Operational execution time measures the execution and verification of the selected recovery commands. TABLE IV: Recovery planning and operational execution time. Scenario Agent Planning (min) Execution (s) Success Novice Our agent 79.8 ± 2.1 43.5 ± 4.8 90% GPT-5.5 28.5 ± 5.6 66.7 ± 12.4 72% Gemini-3.1-Pro 34.4 ± 6.4 74.6 ± 14.2 68% Claude Opus 4.8 29.8 ± 5.8 69.4 ± 12.9 71% Experienced Our agent 102.9 ± 7.7 137.9 ± 6.1 88% GPT-5.5 71.4 ± 8.5 142.8 ± 17.6 66% Gemini-3.1-Pro 82.7 ± 9.6 153.8 ± 21.4 62% Claude Opus 4.8 73.9 ± 8.8 151.6 ± 18.7 67% Expert Our agent 106.7 ± 5.6 144.4 ± 6.4 86% GPT-5.5 77.2 ± 6.3 148.6 ± 18.1 59% Gemini-3.1-Pro 89.6 ± 7.8 165.4 ± 20.2 55% Claude Opus 4.8 80.4 ± 7.1 145.0 ± 17.8 60% V-C Results Discussion For attack inference, precision exceeds 78% across all three scenarios, as shown in Table I. Turning to recovery, Table IV shows that our method achieves recovery success rates of 90%, 88%, and 86% in the novice, experienced, and expert scenarios, versus 72%, 67%, and 60% for the strongest baselines, yielding gains of 18, 21, and 26 percentage points. Execution logs show that our planning agent typically commits six high-level actions per recovered component, corresponding to the six local recovery stages. In contrast, the baselines generate seven to fifteen actions, requiring more command-generation and execution rounds and potentially contributing to longer and more variable execution times. VI Conclusion We present a hierarchical agentic incident-response framework combining LLM-based attack inference, decision-theoretic planning, and digital-twin emulation. Digital-twin replay calibrates inferred attack progression, tactical rollout prioritizes affected components, and planning and execution agents generate recovery actions and commands that are validated in the twin. On a 33-component, multi-subnet testbed under three multi-stage attack scenarios, our framework improves recovery success over frontier-LLM baselines by 18–31 percentage points while achieving the shortest mean operational execution time in every scenario. References [1] Y. Gao, K. Hammar, and T. Li (2026) In-context autonomous network incident response: an end-to-end large language model agent approach. In Proceedings of the 2026 AAAI Summer Symposium Series, Vol. 9. Cited by: §I, §I. [2] Y. Gao, T. Li, and K. Hammar (2026) Agentic incident response through digital twin-enhanced multiscale planning. arXiv preprint arXiv:2608.02422. External Links: Document, Link Cited by: §IV-A, §V-A, §V. [3] Y. Ge, T. Li, and Q. Zhu (2023) Scenario-agnostic zero-trust defense with explainable threshold policy: a meta-learning approach. In IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), IEEE INFOCOM, Vol. 00, p. 1–6. Cited by: §I. [4] M. Grieves and J. Vickers (2016) Digital twin: mitigating unpredictable, undesirable emergent behavior in complex systems. In Transdisciplinary perspectives on complex systems: New findings and approaches, p. 85–113. Cited by: §I. [5] D. Guo et al. (2025) DeepSeek-r1 incentivizes reasoning in LLMs through reinforcement learning. Nature 645 (8081), p. 633–638. External Links: ISSN 0028-0836 Cited by: §IV. [6] K. Hammar, T. Alpcan, and E. C. Lupu (2026) Incident response planning using a lightweight large language model with reduced hallucination. In Network and Distributed System Security (NDSS) Symposium, Cited by: §I, §I, §I. [7] K. Hammar, T. Li, R. Stadler, and Q. Zhu (2025) Adaptive security response strategies through conjectural online learning. IEEE Transactions on Information Forensics and Security 20, p. 4055–4070. External Links: ISSN 1556-6013, 2402.12499 Cited by: §I. [8] K. Hammar and T. Li (2025) Online incident response planning under model misspecification through bayesian learning and belief quantization. In Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security, AISec, p. 40–51. External Links: ISBN 9798400718953 Cited by: §I. [9] K. Hammar (2026) CSLE: a reinforcement learning platform for autonomous security management. In Ninth Conference on Machine Learning and Systems, Cited by: §V-A. [10] P. E. Kaloroumakis and M. J. Smith (2021) Toward a knowledge graph of cybersecurity countermeasures. Technical report The MITRE Corporation. Cited by: §I. [11] T. Li, Z. Bian, H. Lei, F. Zuo, Y. Yang, Q. Zhu, Z. Li, Z. Chen, and K. Ozbay (2025) Digital twin-based driver risk-aware predictive mobility analytics for real-time situational awareness through cooperative sensing. IEEE Transactions on Intelligent Transportation Systems 26 (11), p. 20071–20090. External Links: ISSN 1524-9050 Cited by: §I. [12] T. Li, K. Hammar, R. Stadler, and Q. Zhu (2024) Conjectural online learning with first-order beliefs in asymmetric information stochastic games. In 2024 IEEE 63rd Conference on Decision and Control (CDC), p. 6780–6785. Cited by: §I. [13] T. Li, H. Lei, H. Guo, M. Yin, Y. Hu, Q. Zhu, and S. Rangan (2025) Digital twin-enhanced wireless indoor navigation: achieving efficient environment sensing with zero-shot reinforcement learning. IEEE Open Journal of the Communications Society 6, p. 2356–2372. Cited by: §I. [14] T. Li, H. Lei, and Q. Zhu (2023) Self-adaptive driving in nonstationary environments through conjectural online lookahead adaptation. In 2023 IEEE International Conference on Robotics and Automation (ICRA), Vol. , p. 7205–7211. Cited by: §I. [15] T. Li, Y. Pan, and Q. Zhu (2024) Decision-dominant strategic defense against lateral movement for 5g zero-trust multi-domain networks. In Network Security Empowered by Artificial Intelligence, Y. Chen, J. Wu, P. Yu, and X. Wang (Eds.), p. 25–76. External Links: ISBN 978-3-031-53510-9 Cited by: §I. [16] T. Li and Q. Zhu (2025) Agentic AI for cyber resilience: a new security paradigm and its system-theoretic foundations. arXiv preprint arXiv:2512.22883. Cited by: §I, §I. [17] X. Lin, J. Zhang, G. Deng, T. Liu, T. Zhang, R. Chen, and Q. Guo (2025) IRCOPILOT: automated incident response with large language models. arXiv:2505.20945. External Links: 2505.20945 Cited by: §I, §I. [18] H. Mohammadi, J. J. Davis, M. Kiely, and H. Mohammadi (2025) Leveraging large language models for autonomous cyber defense: insights from CAGE-2 simulations. IEEE Intelligent Systems 40 (4), p. 29–36. External Links: ISSN 1541-1672 Cited by: §I, §I. [19] M. Repetto (2026) Cybersecurity digital twins: concept, blueprint, and challenges for multi-ownership digital service chains. Journal of Information Security and Applications 96, p. 104299. External Links: ISSN 2214-2126 Cited by: §I. [20] S. Vyas, V. Mavroudis, and P. Burnap (2025) Towards the deployment of realistic autonomous cyber network defence: a systematic review. ACM Computing Surveys 58 (1), p. 1–36. External Links: ISSN 0360-0300 Cited by: §I.