Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model
Researchers evaluate a rule-engine and local-LLM incident response subsystem with human approval and safety controls.
A cs.CR paper designs a post-alert incident orchestration subsystem for educational systems that separates classification, contextual analysis, human approval, and technical execution. A rule engine sets severity and selects playbooks, while static RAG and a local large language model provide advice behind validator, guardrail, sanitizer, and safe-fallback controls. Lab tests began from simulated alerts stored in Elasticsearch. The rule engine matched all 30 boundary cases, a durable queue finished 100 events cleanly, and 30 runs averaged about 33 seconds.
- Rule engine matched the routing matrix in all 30 boundary cases.
- Queue completed 100 events without duplicates, failures, or unintended firewall rules.
- An eight-alert test kept only one active local-model request.
- Mean post-alert processing time was about 33 seconds over 30 runs.
From the original article
1 min read at arxiv.orgThis paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution.
By Hoang-Lam Huynh · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.