BlueSTAR: Tiered Agentic Architecture for Autonomous Cyber Defense
BlueSTAR is a tiered agentic LLM architecture for autonomous cyber defense, validated on live enterprise IT/OT cyber ranges against seven attack chains.
Researchers present BlueSTAR, a tiered agentic architecture for autonomous cyber defense in enterprise IT/OT networks that transforms high-volume security telemetry into compact indicators of compromise. It pairs deterministic containment for known threats with LLM reasoning for attacks requiring contextual and cross-cycle analysis, and introduces a resilience metric jointly weighing attacker reach, mission-critical impact, and defensive disruption. Evaluation on two live cyber ranges with seven attack chains based on real-world intrusion techniques covered credential theft, repeated compromise, concurrent attackers, and attacks on physical processes.
- Compresses high-volume telemetry into compact indicators of compromise.
- Retains fast deterministic containment for known threats.
- Handles credential theft, repeated compromise, and concurrent attackers.
- Introduces a resilience metric for autonomous defense evaluation.
- Tested on two live enterprise IT/OT cyber ranges.
From the original article
1 min read at arxiv.orgCyber attacks are increasingly automated, narrowing the time available for human analysts to detect, reason about, and respond to intrusions. Large language models (LLMs) offer a promising foundation for autonomous cyber defense because they can correlate heterogeneous evidence and reason about previously unseen threats.
By Simona Boboila · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.