Agentic Incident Response through Digital Twin-Enhanced Multiscale Planning Yiran Gao1 , Tao Li1 , and Kim Hammar2 City University of Hong Kong, Hong Kong SAR [email protected], [email protected] 2 Imperial College London, United Kingdom [email protected]
arXiv:2608.02422v1 [cs.CR] 3 Aug 2026
1
Abstract. Incident response is currently managed by security operators using predefined playbooks, resulting in slow, labor-intensive security decision-making processes. Consequently, there is a growing need for automated incident response planning. Decision-theoretic approaches based on control, optimization, and reinforcement learning have been proposed to automate such planning tasks with well-grounded approaches, yet most of which, while guaranteeing strong performance, are limited to abstract models and cannot be directly applied to operational systems. A promising approach to mitigate this limitation is to use the security knowledge embedded in large language models (LLMs) to develop agentic response systems. However, current agentic approaches rely on repeated invocations of the LLM to generate a response plan, which is unreliable and limits the planning horizon due to hallucination. In this paper, we develop a principled LLM-based planning method by combining decision-theoretic planning with LLM-generated response commands. The proposed agentic incident response approach uses a rollout planner to compute a high-level response strategy that allocates security resources (the tactical scale), which is then translated into executable commands by a lightweight LLM agent (the operational scale). Within this architecture, we use a digital twin that supports tactical planning through simulation and operational execution through emulation. Across three attack scenarios, our agentic approach reduces recovery execution time by 15.1% on average and increases the recovery rate by 33.6% over frontier LLM baselines. Keywords: Network intrusion response · Response planning · Reinforcement learning · Large language model · Digital twin.
1
Introduction
Incident response refers to the coordinated actions taken to contain, mitigate, and recover from cyberattacks. Today, incident response is largely a manual process carried out by security operators. Though this approach can be effective, it is often slow and requires specialized skills. For instance, a recent report by IBM indicates that 60% of the surveyed organizations take more than 100 days to respond and recover from security incidents in networked systems [24].
2
Gao, Y., Li, T., and Hammar, K.
To address the limitation of manual security operations, autonomous cyber defense (ACD) has emerged as a promising approach for developing agents that can respond to attacks without human intervention [49,43,35]. For incident response planning, existing ACD methods typically rely on abstract decisionmaking models and simulators; see, e.g., [39]. By converting the networked system into an abstract simulation (e.g., a Markov decision process [40,36,51]), these methods make the planning problem tractable and leverage control and optimization, game theory, and reinforcement learning (RL) to compute optimal plans. Yet, this abstraction also limits the practical applicability of the resulting response plans. In particular, response plans produced by current ACD methods operate at the tactical scale: they prescribe high-level defensive actions (e.g., defend this host) without specifying the implementation at the operational scale. A promising approach to close this gap is to use a large language model (LLM) to automatically generate an operational response plan, i.e., one that includes executable commands for a networked system. Unlike abstract decisiontheoretic agents, LLM agents can process large volumes of system logs and generate executable system commands [53]. However, current LLM-based approaches rely mostly on prompt engineering of general-purpose LLMs without principled planning algorithms, which is unreliable and prone to hallucinations [42,6,37]. To address these limitations and bridge the gap between the tactical and opOperational feedback
Security alerts
s1,1
s1,2
s1,3
s2,1
s2,2
s2,3
s3,1
s3,2
s3,3
Response strategy
Decision-theoretic planner (tactical scale)
LLM agent (operational scale)
Response commands
Verified response plan Digital twin
Fig. 1: Illustration of our multiscale approach to agentic incident response planning. Tactical scale: We employ a decision-theoretic planner to generate a highlevel response strategy. Operational scale: We use a Large Language Model (LLM) agent to translate the high-level strategy into executable commands and verify them in a digital twin. erational scales, we propose combining decision-theoretic planning with LLMbased response generation; see Fig. 1. On the tactical scale, we use the lookahead rollout method, a major RL approach [31,5], to compute a high-level response strategy based on an abstract model. This strategy is then fed to an LLM agent, which operates at the operational scale by grounding it in the system context and translating it into an executable response plan. This separation allows the planner to provide tactical guidance, while the LLM handles the system-specific details required for execution. Within this multiscale planning framework, we use a digital twin (i.e., a virtual replica of the system affected by the incident) that supports tactical planning through simulation and operational execution through emulation [18]. In
Agentic Incident Response Multiscale Planning
3
particular, simulation enables computationally efficient planning at the tactical scale by abstracting system details and simulating attack progression across the network, while emulation enables operational-scale response action verification by allowing testing of the generated response plan before deployment. We implement our multiscale architecture on a testbed network comprising five servers (Fig 3) and use it to recover the networked system under three attack scenarios that exploit diverse vulnerabilities across servers. In contrast to LLM agents proposed in prior work [42,6,37], our implementation can be deployed locally and does not rely on an external LLM provider. In particular, we fine-tune the Deepseek-R1-14B LLM [17] on an open-source dataset of 68, 000 incidents and their corresponding responses. Despite being so lightweight (14B parameters compared to ≈ 800B), we show that our system outperforms frontier LLMs by 15% on average across the attack scenarios we evaluated, in terms of recovery time. Moreover, it outperforms frontier LLM baselines by 15.1% on average in recovery execution time, while maintaining a success rate over 90% across distinct scenarios. Our contributions are as follows. – We formulate the incident response as a factorized Markov decision process that separates the network-level, tactical-scale planning from the serverspecific, operational-scale planning. – We develop an agentic incident response framework that integrates decisiontheoretic rollout planning at the tactical scale with LLM-based generation verified by a digital twin at the operational scale. – We implement our architecture using a lightweight LLM and demonstrate that it outperforms the state of the art in recovery-action execution time and success rate for three multi-stage attacks.
2
Related Works
Decision-theoretic incident response. Since incident response can be viewed as a sequential decision-making process, there have been considerable and ongoing efforts to apply control, optimization, and, most recently, reinforcement learning (RL) methods to incident response. The general recipe, which can be traced back to [26], is to first model the response process as a discrete-time control system, where the system state encapsulates the network security posture and control actions are security responses; examples include the Markov decision process (MDP) [49] and the Markov game [2,32], among others. Then, the optimal response plan corresponds to the optimal policy of the sequential decision-making models. Recent developments [23,41] have actively engaged with robust control and optimal control to achieve optimal response planning in the offline design, while online learning [21,20], meta learning [15] and multi-agent learning [29,34] have also been explored recently for online adaptive planning. Related to controltheoretic response planning, RL has emerged as a promising paradigm for datadriven optimal control when closed-form modeling of the network system is un-
4
Gao, Y., Li, T., and Hammar, K.
available [33]. However, RL still relies on an accurate simulator of the target system, which is rarely available in practice. LLM-based approaches for incident response. A promising approach to address the drawbacks of decision-theoretic approaches is to use large language models (LLMs) to automatically generate effective response actions from system logs. This approach is not limited to a predefined set of actions and eliminates the need for a simulator. Early studies in this direction include [42,37,36,50]. These approaches can be separated into two categories: prompt-based LLM orchestration and LLM-RL hybrid approaches. The first category decomposes incident response into several subtasks and develops tailored prompts for LLMs for tackling each task [42,37]. While these works report encouraging results, they have three key limitations: they do not leverage principled planning techniques, they rely on extensive prompt tuning, and most require uploading incident data to external LLM providers. The second category addresses some of these limitations by combining RL and LLM agents, where RL agents supervise the LLM generation [52], LLM agents augment RL agents through knowledge sharing [38], and two agents communicate with each other [6]. Despite the different nature of agentic interactions, these works require additional RL training and LLM-RL joint operations in a simulated environment, leaving a gap between simulation and practical implementation. Most relevant to our work is a line of recent work on integrating decision-theoretic planning with LLM generation [19,13]. However, these approaches use planning methods, e.g., rollout and Monte Carlo tree search, to guide LLM-generated operational response actions. Digital twins in cybersecurity. The concept of digital twins (DTs) originated in the manufacturing, aviation, and physical AI sectors [16,30], where a digital replica runs in parallel with the physical process, offering real-time situational awareness [16,28]. In the context of cybersecurity, DTs provide two main kinds of functionalities: emulation and simulation; see e.g., [9,12,1,10,45,46,11]. Emulation aims to reproduce the target system’s functions and timing behavior in a virtual replica. Such a virtual replica can be used for digital forensics before real-world forensics takes place [9] and for visualizing vulnerabilities [12]. More importantly, it provides a controlled environment for virtual operations, with outcomes that can be used to optimize operations in the target system [46], such as event management [10] and incident prediction [45]. In contrast, simulation is a lightweight abstraction that models selected system aspects to explore security scenarios without reproducing the behavior of the full target system [18]. Novelty of our approach. To our knowledge, we are the first to combine tactical planning with operational response generation, whereas prior work focuses on either tactical planning or operational response generation in isolation. Compared with the most relevant works [19,13], our work features integrated tactical-operational planning that goes beyond LLM-based planning and is augmented with digital-twin verification. Moreover, unlike prior work that typically uses digital twins for either simulation or emulation, our method uses both: simulation for tactical-scale planning and emulation for operational-scale verification.
Agentic Incident Response Multiscale Planning
5
Finally, by fine-tuning a local LLM, as in our previous work [13], our approach is more lightweight and reduces dependence on external LLM providers.
3
Preliminaries
This section presents basic definitions that will be used in the subsequent section covering our methodology. We first describe the main stages of incident response and then review partially observable Markov decision processes (POMDPs) as a formal model for planning under partial observability. Incident Response Planning. Incident response involves selecting a sequence of actions to restore a networked system to a secure, operational state after a cyberattack. These actions should analyze the scope of the attack, secure forensic evidence, contain and evict the attacker, harden the system to prevent recurrence, and restore critical services. Examples of response actions include redirecting network flows, updating access control policies, patching vulnerabilities, shutting down compromised systems, and restarting operational services. We model the system affected by the incident using a graph G = ⟨V, E⟩. The node set V ≜ {1, 2, . . . , N } includes N components, and their interconnections are denoted by the edge set E. The system operator, which we refer to as the defender, monitors the system using infrastructure statistics from an intrusion detection system (IDS). Once an attack has been detected, the defender’s task is to plan a sequence of actions to restore the system to a secure, operational state as quickly as possible. Following the MITRE D3FEND taxonomy [25], we divide the incident response process into the following six stages. 1. Containment: isolating the attack and preventing it from spreading to other connected components. 2. Assessment: identifying the scope and severity of the attack. 3. Preservation: preserving forensic evidence for analysis. 4. Eviction: revoking the attacker’s access to the system. 5. Hardening : patching vulnerabilities and hardening the system to prevent recurrence of the attack. 6. Restoration: restoring services and user access. The goal of the defender is to find a sequence of actions that drives the affected system through these response stages as quickly as possible while minimizing operational costs. A key challenge in selecting such actions is that the available information about the attack is often limited to partial indicators of compromise, e.g., IDS alerts. Moreover, the attacker’s tactics are generally unknown. Partially Observable Markov Decision Processes. Given the partial observability of the system’s security state, we formulate incident response planning as a partially observable Markov decision process (POMDP). We briefly review the formalism of POMDPs for a general use case, deferring the details of our multiscale planning system model to the next section. A POMDP evolves over time steps t = 0, 1, 2, . . .. At each time step t, the system’s security status is represented by the unobservable state variable st . The
6
Gao, Y., Li, T., and Hammar, K.
defender has access to an observation ot that represents system metrics correlated with the recovery state (e.g., log files and IDS alerts). Specifically, the correlation between states and observations is modeled by an observation kernel O(ot | st ), which defines the probability of observing ot in state st . At each time step t, a response strategy π prescribes an action at = π(o0:t ) that influences the system’s state evolution according to the Markov transition kernel Pθ , where θ denotes the attacker’s tactics and Pθ (st+1 | st , at ) specifies the probability of transitioning to state st+1 when executing response action at in state st . We assume the existence of an absorbing terminal state sT such that Pθ (sT | sT , a) = 1 for all actions. This state models the operating conditions when the system has fully recovered and remains operational thereafter. The time required to implement each response action may vary. For example, isolating a compromised host may take a few seconds, while performing forensic analysis of affected systems may last several hours. We model this time through a cost function c, where c(st , at ) represents the time to execute response action at in state st . Naturally, c(sT , a) = 0 for all response actions a, since the terminal state does not require any response. Given this cost function,h the problem of i PH minimizing the recovery time can be expressed as minπ EPθ ,π t=0 c(st , at ) , where H is a finite time horizon.
4
Formalizing the Incident Response Use Case
We formulate incident response as a planning process at two levels: (i ) tactical planning for allocating security resources to system components; and (ii ) operational planning of recovery actions for those components. To capture this two-level planning mathematically, we model incident response as a factorized POMDP where the state st is decomposed into a security posture (tactical level) and a local recovery status (operational level), as detailed below. System states. Consider an IT infrastructure with N components. Each component can be in two global states: safe (0) or compromised (1). Consequently, the global security state is the Boolean vector: gt = (gt1 , . . . , gtN ), gtk ∈ {0, 1}. Moreover, each component k is associated with a local recovery state, which is defined as the 6-dimensional Boolean vector k(c)
ℓkt = (ℓt
k(a)
, ℓt
k(p)
, ℓt
k(e)
, ℓt
k(h)
, ℓt
k(r)
, ℓt
),
ℓkt ∈ {0, 1}6 ,
where the lth entry indicates whether the lth response stage in Section 3 has been k(c) k(c) completed. For example, ℓt = 1 if the attack has been contained; ℓt = 0 otherwise. Hence, the system state st is obtained by concatenating the global and local states, i.e., st = ((gtk , ℓkt )k∈[N ] ), where [N ] ≜ {1, 2, . . . , N }. Beliefs. As discussed in Section 3, the state is unobservable to the defender who needs to form a belief of the state using partial observations o0:t . Mathematically, a belief is a probability distribution over possible states. Due to the binary structure of st , the probabilistic belief admits the representation bt = (bgt , (bkt )k∈[N ] ), where bgt ∈ [0, 1]N and bgt (k) indicates the probability of the k-th component
Agentic Incident Response Multiscale Planning
7
k(i)
being safe. Similarly, bt indicates the probability that the i-th response stage has been completed for component k. One important assumption we impose is that each server’s state is independent of the rest, and hence, bgt is a product of Bernoulli distributions. This assumption greatly simplifies the belief space. Actions. Since tactical and operational planning are distinct, we model a response action as a tuple at = (agt , aℓt ), where agt is the action on the tactical level and aℓt is the action at the operational level. Specifically, the tactical action agt is a permutation of {1, 2, . . . , N } indicating the response priority over the networked components, where agt (k) is the priority of system component k. Similarly, the operational action aℓt corresponds to the recovery action (e.g., a system command) applied to the prioritized system component. Costs. Given these definitions of the security state st and response action at , we define the cost function as c(st , at ) = cg (gt , agt ) + cℓ (ℓt , aℓt ), where cℓ models the time required to execute the selected recovery action on the chosen component and cg captures the cost of delaying recovery for the remaining components. This delay matters because unattended compromised components may vary in criticality and importance. To model this importance, we define r(gt ) ∈ RN to be a vector of importance P weights, where rk (gt ) is the importance of component k in global state gt and r (g ) = 1. Given these importance weights, P k∈[N ] k t g g g we define c (gt , at ) = λ r (g )a (j) cℓ (ℓt , aℓt ), where k is the component j̸=k j t t selected for recovery. Thus, the global cost penalizes recovery orders that leave important or risky components waiting. The parameter λ ∈ (0, 1] controls the relative weight of the delay cost compared with the execution time cost. We illustrate this cost definition through the following example. Compromised
Safe
Step t: before recovering central server
Step t+1: after recovering central server
v1 0.8
Top priority
Recovered
v1 0.8
0.7
v2
v3
0.7
v2
v3
0.4
0.3
0.7
0.6
0.4
0.3
0.7
0.6
v4
v5
v6
v7
v4
v5
v6
v7
Priority order: ag t (v1 )=1, g ag t (v2 )=2, at (v3 )=3
Updated priority: ag t+1 (v3 )=1, ag t+1 (v2 )=2
Fig. 2: Representation of the global state gt and the priority weights r(gt ) as an attack graph; cf. Example 1. Nodes represent system components i ∈ {1, . . . , N }, which are colored green if gti = 0 and red otherwise. Edges represent attack steps with the associated probabilities. The top priority node is indicated in orange. The left and right graphs represent the priorities at time t and t+1, respectively.
8
Gao, Y., Li, T., and Hammar, K.
Example 1. The global state gt and the priority weights r(gt ) can be illustrated using an attack graph, where nodes represent system components, directed edges represent attack steps, and edge weights represent probabilities of attack steps; see Fig. 2. As shown in the left graph of Fig. 2, system component v1 receives the highest priority at step t because it connects two compromised regions of the network. Recovering v1 can therefore reduce the risk of further attack propagation. After component v1 is recovered, the priorities among the remaining unrecovered components change, which results in a new attack graph with a different structure, as shown in the right graph of Fig. 2. State dynamics. State transitions are coupled across the global and local scales. In particular, the local recovery action aℓt updates the local state ℓkt according to agt , which determines whether the global state of that component (i.e., gtk ) is updated or not. This coupling gives the factorized transition model Pθ (st+1 | st , at ) = Pθg (gt+1 | gt , agt )Pθk (ℓkt+1 | ℓkt , aℓt ), agt (k) = 1, where k denotes the component selected for recovery and Pθk models the progress of component k through the response stages under action aℓt . The global state transition follows from the outcome of the local action. Specifically, if component k is compromised and its local state reaches the recovered state ℓkT = (1, 1, 1, 1, 1, 1), then its global k k state becomes safe (gt+1 = 0). Otherwise, it remains compromised (gt+1 = 1), as formally expressed below. k k Pθg (gt+1 = 0 | gtk = 1) = 1{ℓkt+1 = ℓkT }, Pθg (gt+1 = 1 | gtk = 1) = 1{ℓkt+1 ̸= ℓkT }.
For all other components, the global state transition is governed by the attack graph, which models how the attack spreads from the compromised nodes. Specifically, let gt−k denote the global state of all components except k, i.e., −k −k k k | gt−k ). gt+1 = (gt+1 , gt+1 ). Then, Pθg (gt+1 | gt , agt ) = Pθg (gt+1 | gtk )Pθg (gt+1 These definitions imply that the global and local transition kernels differ in both timescale and granularity. In particular, the global state gtk changes only after component k has completed several recovery steps and reached its terminal recovery state. Thus, global transitions describe network-level changes in compromise status, while local transitions capture the detailed recovery progress of an individual component, which motivates our multiscale planning approach.
5
Agentic Multiscale Response Planning
In this section, we present our method for incident response planning. It includes an offline stage and an online stage. In the offline stage, we fine-tune a lightweight LLM using incident response examples. In the online stage, we use the fine-tuned LLM and a digital twin to plan responses at two scales: tactical and operational. At the tactical scale, a decision-theoretic planner uses digital twin simulation to prioritize which component to recover next. At the operational scale, an LLMbased agent generates recovery actions for that component and verifies them through digital twin emulation.
Agentic Incident Response Multiscale Planning
5.1
9
Offline Fine-tuning of a Lightweight LLM
We adapt the DeepSeek-R1-14B [17] LLM to incident response by fine-tuning it on a labeled dataset of incident descriptions. We fine-tune three variants of the model, each corresponding to a different stage of the response workflow. Incident assessment fine-tuning. We start by fine-tuning the LLM to infer likely attacker tactics and techniques from an incident description, such as system logs and security alerts. We conduct this fine-tuning by training the LLM on a labeled dataset of incident examples, denoted by Dincident = {(xi , yi )}K i=1 . Each input xi contains an incident description (e.g., security alerts), while the target output yi contains the corresponding MITRE ATT&CK tactics and techniques [48]. Tokenizing each label as yi = (y1i , . . . , yli ), we fine-tune the model by sampling mini-batches and minimizing the standard autoregressive cross-entropy loss, where Φw denotes the LLM with tunable model weights w ∈ Rd . B
l
i 1 XX i log Φw (yki |xi , y1:k−1 ). L(w) = − B i=1
(1)
k=1
Belief generation fine-tuning. Next, we apply the same fine-tuning method to adapt a version of the LLM for belief estimation. Specifically, given incident observations and previous actions, the model is trained to estimate the belief bt and an evidence summary mt , which contains the observations that support bt . The training data consists of instruction-answer pairs where the input describes the incident context and the output provides the corresponding belief bt and evidence summary mt . This fine-tuning enables the agent to compress incident context (e.g., logs and alerts) into a compact belief representation (bt , mt ). Response action fine-tuning. Lastly, we apply the same fine-tuning method to adapt a version of the LLM to generate response actions conditioned on the current belief state. In this case, each training example provides the incident description, the current belief (bt , mt ), and the previous response action at−1 as input. The model is then trained to predict the next local action aℓt , which can be verified in the digital twin, as detailed below. 5.2
Digital Twin for Simulation and Emulation
The digital twin is an isolated execution environment that replicates the relevant hosts, services, and configurations of the system affected by the incident, as shown in Fig. 3. It provides a safe environment to investigate the incident and evaluate response actions. For example, if the incident occurs in a cloud environment, then the digital twin can be created by taking snapshots of system components and deploying them in a private cloud. Without such a digital twin, investigation and testing must be performed directly on the affected system, which increases risks and operational costs. In our method, the digital twin supports two complementary modes of execution: simulation and emulation. In simulation mode, it uses a network attack
10
Gao, Y., Li, T., and Hammar, K. D IGITAL T WIN
Emulated actors
Server network 10.0.2.0/24
...
SSH 10.0.2.11 Weak credentials
Emulated services
Client network 10.0.1.0/24
Virtual network
Samba 10.0.2.12 SambaCry, CVE-2017-7494 Shellshock 10.0.2.13 CVE-2014-6271
Virtual devices
Client 10.0.1.11
A FFECTED SYSTEM
Selective replication
Gateway Snort IDS + Router eth0 10.0.1.10 eth1 10.0.2.10
Web 1 (Nginx) 10.0.2.14 Web-accessible upload Web 2 (Nginx) 10.0.2.15 Diagnostic command injection
Fig. 3: (Left) The digital twin is a virtual replica of the affected system, which offers a safe environment for investigating the incident and testing response actions. (Right) The network digital twin configuration adopted in our testbed. graph to evaluate attack progression and compare recovery-priority orders efficiently. This mode is used for tactical planning, where the goal is to decide which component to recover next. In emulation mode, the digital twin executes candidate recovery actions in a replica of the affected environment. This mode is used for operational planning, where the goal is to test whether generated response actions are effective before applying them to the operational system. Identification of an attack graph for simulation. Before initiating tactical response planning, we use the digital twin and the previously fine-tuned LLM to identify an attack graph for simulation. To this end, we prompt the LLM with the incident description I and use it to generate an initial assessment of the likely attack tactics and techniques. We refer to this estimate as an attack conjecture. To improve the robustness of this conjecture, we run M = 10 independent generations and retain only tactics and techniques with empirical frequency exceeding 0.5. We denote the resulting conjecture by θ̂ ← Φw (· | I). We then use the digital twin to extract dependencies among system components, thereby defining a dependency graph G. For each edge i → j ∈ G, we repeatedly test the attack techniques in θ̂ that could enable this attack step. Subsequently, we use the outcomes of these tests to estimate the probability of the attack step i → j, and denote the resulting attack graph by G(θ̂). 5.3
Tactical and Operational Scale Planning
Tactical Planning. The attack graph G(θ̂) induces a transition model P̂ g (gt+1 | gt , agt ) of the global state, which we use for tactical scale planning to decide which system component should be recovered next. This tactical planning involves comparing candidate recovery orders through lookahead simulations based on the attack graph and then selecting to the minimal cost, which Pthe order that leads g g g we compute as ĉ (gt , at ) ≈ λ j̸=k rj (gt )at (j) τavg , where k is the component placed first in the recovery order and τavg is the average local execution time of previously attended nodes. We use the average time since the exact recovery time is not known before selecting a component.
Agentic Incident Response Multiscale Planning
11
To evaluate candidate recovery orders, we first use the fine-tuned LLM to generate a belief state bt . We then use this belief state to sample Mg possible global states as {ĝti }i∈[Mg ] ∼ bgt and simulate Hg lookahead steps in the attack graph. We then estimate the cost of the resulting rollout by averaging the P PHg g i i ĉ (ĝt+k , âg ), where ĝt+k ∼ P̂ g (· | sampled states as J(âg ) = M1g i∈[Mg ] k=0 i ĝt+k−1 , âg ). Next, we select the recovery order with the lowest estimated cost: g at = arg minâ∈Agt J(â). Since enumerating all N ! recovery orders is computationally infeasible for large systems, we restrict this minimization to candidate orders derived by permuting the previous order agt−1 . Operational Planning. Given the belief and system components selected by tactical planning, operational planning decides how to recover those components, i.e., it determines the next local recovery action aℓt . This planning process involves three main steps. First, we use the fine-tuned LLM to generate a set ℓ of candidate response actions Aℓt = {â1t , â2t , . . . , âN t }. Second, we evaluate the candidate actions using LLM-generated recovery rollouts. In particular, for each candidate action âit , we use the fine-tuned LLM to generate Mℓ > 0 recovery trajectories. Each trajectory starts with an action âit and continues until the target component reaches the recovered state ℓT = (1, 1, 1, 1, 1, 1). These rollouts are then used to estimate the remaining recovery cost as ( DT-Emul(â), if verified by DT, 1 X X i Q(bt , ât ) = c(â), c(â) = Mℓ ∞, otherwise, i,j j∈[Mℓ ] â∈q
where q i,j is the jth rollout trajectory starting from action âit , and the time cost of each action is estimated by execution time in the digital twin, denoted by DT-Emul(â). If the action is not executable, the cost is set to ∞. The third step selects the action with the lowest estimated cost. We then execute the selected action in the digital twin. As a result of this execution, the digital twin produces a new observation ot+1 (e.g., the outcome of the action), which we feed to the fine-tuned LLM to generate a new belief (bt+1 , mt+1 ). We then repeat the same planning procedure from the new belief. This process of planning a local recovery action, executing it, and updating the belief continues until the component is recovered
6
Experiment
In this section, we present an experimental evaluation of our method for agentic response planning. We start by assessing the effectiveness of offline fine-tuning. We then compare the recovery-action execution time and recovery rate of our method with frontier LLMs and two state-of-the-art baselines: ircopilot [37] and llm-ir [19]. 6.1
Experiment Setup
We instantiate the LLM Φw [cf. (1)] with DeepSeek- R1- Distill- Qwen- 1 4B and fine-tune its weights using LoRA. The base-model parameters remain
12
Gao, Y., Li, T., and Hammar, K.
frozen during fine-tuning, while the trainable parameters are restricted to the LoRA adapter weights. The hyperparameters used for fine-tuning are available in Appendix A. The prompt templates and related artifacts are available online3 . Fine-tuning datasets. We use the training dataset from [19] to fine-tune the LLM. This dataset is divided into three separate fine-tuning datasets: D = Dincident ∪ Dstate ∪ Daction to fine-tune three versions of the LLM. First, we use Dincident for incident-assessment fine-tuning, where each training example consists of a system description and security logs. The model is finetuned to decide whether the evidence in the logs indicates an incident, summarize the incident, identify involved entities, and assign MITRE ATT&CK tactics. Second, we use Dstate for belief-generation fine-tuning, where each training example includes the system description, logs, incident summary, local state, and previously executed response actions. The model is trained to predict the next global and local recovery state, along with a summary of evidence. The belief is obtained by the empirical distribution of repeatedly generated state predictions. Third, we use Daction , for action-generation fine-tuning, where each training example instructs the model to generate the next response action based on the local state and previous actions. Digital twin. We use a dockerized digital twin that emulates a small segmented enterprise network with two subnets: a client network 10.0.1.0/24 and a server network 10.0.2.0/24; see Fig. 3. The two subnets are connected by a gateway container, which acts as both the network router and the IDS monitoring point. The gateway has IP address 10.0.1.10 on the client network and 10.0.2.10 on the server network. It runs Snort to collect alerts and uses iptables to support containment and recovery actions. The client container has IP address 10.0.1 .11 and serves as the attack platform in the experiments. It includes common network and exploitation tools, including nmap, hydra, curl, smbclient, and sshpass. The roles of the components are summarized in Table 7 in Appendix A. Attack scenarios. We consider three different attack scenarios to evaluate our method. These scenarios, which we refer to as Weak-Credential-3, Shellshock4, and Command-Injection-5, are designed to exhibit different combinations of attack patterns (e.g., command injection) that compromise different nodes in the digital twin. We defer the detailed setup to Appendix A. 6.2
LLM Generation Evaluation
In this section, we present an evaluation of the generation capabilities of the fine-tuned LLMs. For each fine-tuned LLM, we evaluate the LLM on a set of testing incident examples reported in the literature, listed in Table 1. Incident assessment evaluation. We begin by evaluating the fine-tuned LLM’s ability to identify MITRE ATT&CK tactics from incident descriptions and security logs. For each ground-truth tactic in the test data, we define precision as the fraction of predicted instances that correctly include the tactic among 3
GitHub repository:https://github.com/TaoLi-NYU/Agentic-Incident-Respons e-ESORICS26
Agentic Incident Response Multiscale Planning Dataset
Systems
Attacks
13
logs
CTU-Malware-2014 [14] windows xp sp2 Malwares and ransomwares snort alerts CIC-IDS-2017 [47] windows, linux Denial-of-Service, web attacks, sql injections, and etc. snort alerts AIT-IDS-V2-2022 [27] windows, linux Multi-stage attacks from reconnaissance to escalation wazuh alerts CSLE-IDS-2024 [22] linux Software exploits, e.g., cve-2015-1427 snort alerts
Table 1: The four evaluation datasets used to evaluate the fine-tuned LLMs. all predictions, and recall as the fraction of testing instances that contain the tactic and are correctly predicted. Table 2 summarizes the results. We observe that the prediction accuracy is positively correlated with the occurrences of each tactic in the training dataset. Moreover, we find that the model achieves high precision and recall (≥ 0.85) for the most common tactics (e.g., reconnaissance), but lower accuracy for the less common tactics (e.g., discovery).
Tactic Reconnaissance Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command and Control Exfiltration Impact
Precision Recall F1 1.000 0.839 0.938 0.500 0.378 0.417 0.733 0.333 0.527 0.571 0.690 0.833 0.818
caa-F1 csa-F1
ℓc
ℓa
ℓp
ℓe
ℓh
ℓr
0.857 0.923 F1 0.9902 0.9822 0.9975 0.9964 0.9970 0.9952 0.9541 0.9533 0.975 0.902 0.974 0.955 Table 3: Evaluation of the LLM for belief gen0.667 0.571 eration; reproduced from Tab. 2 [13]. 0.583 0.459 0.714 0.526 0.647 0.688 0.765 0.464 0.879 0.659 Scenario Ground truth Predicted belief BCE 0.800 0.667 (0, 0, 0, 1, 1) (0.04, 0.06, 0.08, 0.58, 0.58) 0.2551 0.925 0.790 Weak-Credential-3 (0, 0, 0, 0, 1) (0.04, 0.08, 0.04, 0.10, 0.92) 0.0708 0.893 0.862 Shellshock-4 0.818 0.818 Command-Injection-5 (0, 0, 0, 0, 0) (0.10, 0.12, 0.10, 0.26, 0.10) 0.1490
Table 2: Evaluation of the LLM Table 4: Evaluation of the LLM for belief generation. for incident assessment. Belief generation evaluation. Since each local recovery state is a six-dim Boolean vector (see Section 3), predicting the local state is a multi-label binary classification problem. For this reason, we evaluate the LLM’s predictions using the F1 score. In addition to the F1 score, we also measure two averaged F1 scores: (i ) class-agnostic average F1 (caa-F1), which aggregates True Positive (TP)/ False Positive (FP)/ False Negative (FN) across all entries before computing F1; and (ii ) class-specific average F1 (csa-F1), which computes F1 per Boolean entry and then averages across entries. The F1 scores are summarized in Table 3. We find that our lightweight LLM can accurately predict the recovery state. In addition to the evaluation in terms of the F1 score of the state prediction, we consider the LLM-generated global state beliefs specific to the three attack scenarios in the digital twin. Specifically, Table 4 lists the binary cross-entropy between the generated belief and the true state. We observe in the table that the generated beliefs put most probability mass on the true state. Response action generation evaluation. We then evaluate the response actions generated by the fine-tuned LLM for the five most frequent MITRE ATT&CK tactics in the testing dataset. For each tactic, we randomly select 30 incident examples and prompt the model to generate actions, whose effectiveness
14
Gao, Y., Li, T., and Hammar, K.
is judged by codex, a gpt-powered coding agent with access to the ground-truth actions. A generated action is said to pass the test if it advances the recovery progress to the same extent as the ground-truth action. Table 5 summarizes the pass rate across the 150 testing examples, indicating that our model can generate effective actions for different tactics. MITRE ATT&CK tactics
#
Pass
Fail
Initial Access, Execution, Collection, Exfiltration Initial Access, Execution, Command and Control, Exfiltration Initial Access, Execution, Credential Access, Exfiltration Impact Initial Access, Execution, Command and Control
30 30 30 30 30
24 (80.0%) 23 (76.7%) 28 (93.3%) 25 (83.3%) 28 (93.3%)
6 (20.0%) 7 (23.3%) 2 (6.7%) 5 (16.7%) 2 (6.7%)
Overall
150 128 (85.3%) 22 (14.7%)
Table 5: Evaluation of the LLM for action generation. 6.3
Recovery-Action Execution-Time Evaluation
In this section, we evaluate the execution performance of our agentic method using response action execution time (s) and recovery rate (%). Execution time excludes planning, LLM inference, and DT-verification. We consider two evaluation metrics: the recovery time (s) and the recovery rate (%). The former measures the average time to recover the system from an incident using the planned sequence, and the latter measures the percentage of fully recovered incidents among those evaluated. We highlight that the recovery time excludes the planning time, LLM inference time, and DT verification time. All evaluations are performed using the digital twin shown in Fig. 3 and the incidents (attack scenarios) described in Appendix A. Baselines. We use six baselines. The first four baselines are the current frontier LLMs, namely: gpt-5.5 [44], gemini-3.1-pro [7], deepseek-v4-pro [8], and claude-opus-4.8 (high effort) [3]. Compared with these LLMs, our method is significantly more lightweight and fine-tuned towards the incident response use cases. In addition to the frontier LLMs, we compare the performance of our method with that of ircopilot [37] and llm-ir [19], both of which are agentic response methods proposed in the literature. Compared with our agent, ircopilot uses our fine-tuned model only for operational planning, and llm-ir uses LLM-based rollout at the operational scale without digital twin verification. The two baselines constitute ablations of the usage of rollout and digital twin. Evaluation scenarios. We consider two evaluation scenarios. In the first scenario, we use the tactical-scale plan produced by our method to evaluate all baselines. Hence, this evaluation scenario compares the operational-scale planning capabilities of the different methods. In the second scenario, we measure the benefit of the tactical planning component of our method by prompting each baseline method to perform tactical-scale planning as well. Evaluation results. The results for evaluation scenario 1 are summarized in Figs. 4a, 4b, and 4c. Bar colors represent different methods; numbers and error bars indicate the mean and standard deviation from 50 independent runs using
Agentic Incident Response Multiscale Planning
15
distinct random seeds. Notably, the recovery rates of our method, which are around 90% in three attack scenarios, surpass all other baselines by a large margin. In contrast, the frontier models only achieve rates below 75%, and the rates for two LLM-based approaches are between 50% and 65%. Moreover, our method achieves the shortest average recovery time, outperforming the frontier models by 15.1%. We attribute this result to the fine-tuning.
0
0 our agent claude-opus-4.8
gpt-5.5 llm-ir
gemini-3.1-pro-preview ircopilot
71.46
89.91
50
0
deepseek-v4-pro
Recovery rate (%)
100 62.5%
54.3%
60.86
67.3%
67.28 52.3%
64.9%
66.52
92.6% 60.49
50
49.8%
50
50
Recovery time (s)
Recovery rate (%)
58%
56.3%
71.4%
76.73
53.2%
50.89
57.1%
60.11
68.2% 49.79
52.94
100 44.47
100
100
59.79
94.4%
150 Recovery time (s)
118.87
The evaluation results related to scenario 2 are summarized in Fig. 4d. Similar to the results for scenario 1, we see that our method maintains a recovery rate of around 90% on average, which is above 30% higher than the two baselines. The average recovery time of our method is 57.8% and 53.9% less than those of llm-ir and ircopilot, respectively. These results highlight the benefit of tactical planning.
0
our agent claude-opus-4.8
gpt-5.5 llm-ir
gemini-3.1-pro-preview ircopilot
deepseek-v4-pro
0 gpt-5.5 llm-ir
gemini-3.1-pro-preview ircopilot
deepseek-v4-pro
173.6
Recovery rate (%)
51.4%
42.5%
50
0
0
0 our agent claude-opus-4.8
100
150.7
89.7% 75.2
133.3
120.1 54.8% 59.8
45.8%
92.6%
115.5 116 48.2%
100 44.5
Recovery time (s)
Recovery rate (%)
64.7%
47.9%
50
58.3%
200
100
50
94.4%
111.48
124.94 64.2%
86.51
46.8%
113.52 47.3%
100.36
61%
100
75.18
Recovery time (s)
150
87.39
89.7%
(a) Evaluation scenario 1, attack scenario (b) Evaluation scenario 1, attack scenario Weak-Credential-3. Shellshock-4.
Weak-Credential-3
our agent
Shellshock-4 Command-Injection-5
ircopilot
llm-ir
(c) Evaluation scenario 1, attack scenario (d) Evaluation scenario 2, across three atCommand-Injection-5. tack scenarios.
Fig. 4: Evaluation of recovery-action execution time and rate in the end-to-end incident response. The bars relate to the recovery time (↓ better) and the recovery rate (↑ better).
16
6.4
Gao, Y., Li, T., and Hammar, K.
Discussion
The experimental results demonstrate that our method for agentic multiscale response planning consistently outperforms the frontier LLMs and prior works on LLM-based incident response across three attack scenarios. The comparisons with frontier LLMs suggest that a tailored, lightweight model powered by decision-theoretic planning provides a sufficient agentic approach for incident response. We attribute this result to the digital twin-based verification, which leads to higher recovery rates in our evaluation. Moreover, compared with prior LLM-based incident response approaches, the tactical-scale planning in our method improves performance by strategically selecting the recovery order. Limitations. One limitation of our method is the misspecification of attack tactics during incident assessment. If the inferred attack conjecture deviates from the true tactics, the attack graph becomes inaccurate, and tactical-scale planning becomes less effective. While prior work has begun to address misspecification in security settings [21,20], this challenge remains unexplored when an LLM (i.e., a black-box generative model) serves as the inference model. Another limitation of our method is the cost of LLM-based rollout in operational planning. Failed verification adds extra cost due to regeneration and digital twin reinitialization. This can be partially mitigated through parallel LLM sessions and digital twin emulations. Connections to response playbooks. Our agentic response planning method serves a similar role to incident response playbooks [4], but focuses on generating executable operational actions. Compared with conventional playbooks, it offers two advantages. First, it produces concrete and context-specific actions tailored to the system of interest. Second, it acts as a dynamic playbook by prioritizing compromised nodes through multiscale planning.
7
Conclusion
We present an agentic approach that integrates decision-theoretic planning, large language models (LLMs), and digital twins for incident response planning. The proposed method uses a rollout planner based on digital twin simulation to compute a high-level response strategy that allocates security resources at the tactical scale. A lightweight LLM, fine-tuned over public incident datasets, translates the abstract strategies into executable commands verified by the digital twin emulation at the operational scale. We evaluate the agentic response planning approach on logs reported in the literature and three distinct attack scenarios on a testbed. Across three scenarios, our agentic approach maintains a recovery rate of around 90%, reduces recovery-action execution time by 15.1% on average, and increases the recovery rate by 33.6% over the frontier LLMs. A primary direction for future work is to address the attack tactics misspecification in the LLM-based incident assessment, which plays an instrumental role in tactical planning. The key is to leverage LLMs’ in-context learning ability to calibrate their inference about potential tactics in the network by comparing observed alerts with predicted alerts under misspecified tactics.
Agentic Incident Response Multiscale Planning
17
References 1. Allison, D., Smith, P., McLaughlin, K.: Digital twin-enhanced methodology for training edge-based models for cyber security applications. In: 2022 IEEE 20th International Conference on Industrial Informatics (INDIN). pp. 226–232 (2022) 2. Alpcan, T., Başar, T.: Network Security: A Decision and Game-Theoretic Approach. Cambridge University Press, USA, 1st edn. (2010) 3. Anthropic: System card: Claude opus 4.8 (2026), [Online] Available at https: //www.anthropic.com/news/claude-opus-4-8 4. Applebaum, A., Johnson, S., Limiero, M., Smith, M.: Playbook oriented cyber response. In: 2018 National Cyber Summit (NCS). pp. 8–15 (2018) 5. Bertsekas, D.P.: Model predictive control and reinforcement learning: A unified framework based on dynamic programming. IFAC-PapersOnLine 58(18), 363–383 (2024) 6. Castro, S.R., Campbell, R., Lau, N., Villalobos, O., Duan, J., Cardenas, A.A.: Large language models are autonomous cyber defenders. In: IEEE Conference on Artificial Intelligence Workshop on Adaptive Cyber Defense (2025) 7. DeepMind, G.: Gemini 3.1 pro: Model card (2026), [Online] Available at https: //storage.googleapis.com/deepmind-media/Model-Cards/Gemini-3-1-Pro-M odel-Card.pdf 8. DeepSeek-AI: DeepSeek-V4: Towards highly efficient million-token context intelligence (2026), [Online] Available at https://arxiv.org/pdf/2606.19348 9. Dietz, M., Englbrecht, L., Pernul, G.: Enhancing industrial control system forensics using replication-based digital twins. In: Peterson, G., Shenoi, S. (eds.) Advances in Digital Forensics XVII. pp. 21–38. Springer International Publishing, Cham (2021) 10. Dietz, M., Pernul, G.: Unleashing the digital twin’s potential for ICS security. IEEE Security & Privacy 18(4), 20–27 (2020) 11. Dietz, M., Vielberth, M., Pernul, G.: Integrating digital twin security simulations in the security operations center. Proceedings of the 15th International Conference on Availability, Reliability and Security pp. 1–9 (2020) 12. Eckhart, M., Ekelhart, A., Weippl, E.: Enhancing cyber situational awareness for cyber-physical systems through digital twins. In: 24th IEEE International Conference on Emerging Technologies and Factory Automation (ETFA). vol. 1, pp. 1222–1225 (2019) 13. Gao, Y., Hammar, K., Li, T.: In-context autonomous network incident response: An end-to-end large language model agent approach. In: Proceedings of the 2026 AAAI Summer Symposium Series. vol. 9 (2026) 14. García, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Computers & Security 45, 100–123 (2014) 15. Ge, Y., Li, T., Zhu, Q.: Scenario-agnostic zero-trust defense with explainable threshold policy: A meta-learning approach. In: IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). IEEE INFOCOM, vol. 00, pp. 1–6 (2023) 16. Grieves, M., Vickers, J.: Digital twin: Mitigating unpredictable, undesirable emergent behavior in complex systems. In: Transdisciplinary perspectives on complex systems: New findings and approaches, pp. 85–113. Springer (2016) 17. Guo, D., et al.: DeepSeek-r1 incentivizes reasoning in LLMs through reinforcement learning. Nature 645(8081), 633–638 (2025) 18. Hammar, K.: CSLE: A reinforcement learning platform for autonomous security management. In: Ninth Conference on Machine Learning and Systems (2026)
18
Gao, Y., Li, T., and Hammar, K.
19. Hammar, K., Alpcan, T., Lupu, E.C.: Incident response planning using a lightweight large language model with reduced hallucination. In: Network and Distributed System Security (NDSS) Symposium 2026 (2026) 20. Hammar, K., Li, T.: Online incident response planning under model misspecification through bayesian learning and belief quantization. In: Proceedings of the 18th ACM Workshop on Artificial Intelligence and Security. pp. 40–51. AISec (2025) 21. Hammar, K., Li, T., Stadler, R., Zhu, Q.: Adaptive security response strategies through conjectural online learning. IEEE Transactions on Information Forensics and Security 20, 4055–4070 (2025) 22. Hammar, K., Stadler, R.: The csle-ids-2024 dataset (2024), [Online] Avaiable at https://doi.org/10.5281/zenodo.10706475 23. Iannucci, S., Abdelwahed, S., Montemaggio, A., Hannis, M., Leonard, L., King, J.S., Hamilton, J.A.: A model-integrated approach to designing self-protecting systems. IEEE Transactions on Software Engineering 46(12), 1380–1392 (2018) 24. IBM Security: Cost of a data breach report 2025. Tech. rep., IBM and Ponemon Institute (2025) 25. Kaloroumakis, P.E., Smith, M.J.: Toward a knowledge graph of cybersecurity countermeasures. Tech. rep., The MITRE Corporation (2021) 26. Kreidl, O., Frazier, T.: Feedback control applied to survivability: a host-based autonomic defense system. IEEE Transactions on Reliability 53(1), 148–166 (2004) 27. Landauer, M., Skopik, F., Wurzenberger, M.: Introducing a new alert data set for multi-step attack analysis. In: Proceedings of the 17th Cyber Security Experimentation and Test Workshop. p. 41–53 (2024) 28. Li, T., Bian, Z., Lei, H., Zuo, F., Yang, Y.T., Zhu, Q., Li, Z., Chen, Z., Ozbay, K.: Digital twin-based driver risk-aware predictive mobility analytics for real-time situational awareness through cooperative sensing. IEEE Transactions on Intelligent Transportation Systems 26(11), 20071–20090 (2025) 29. Li, T., Hammar, K., Stadler, R., Zhu, Q.: Conjectural online learning with firstorder beliefs in asymmetric information stochastic games. In: 2024 IEEE 63rd Conference on Decision and Control (CDC). pp. 6780–6785 (2024) 30. Li, T., Lei, H., Guo, H., Yin, M., Hu, Y., Zhu, Q., Rangan, S.: Digital twin-enhanced wireless indoor navigation: Achieving efficient environment sensing with zero-shot reinforcement learning. IEEE Open Journal of the Communications Society 6, 2356–2372 (2025) 31. Li, T., Lei, H., Zhu, Q.: Self-adaptive driving in nonstationary environments through conjectural online lookahead adaptation. In: 2023 IEEE International Conference on Robotics and Automation (ICRA). pp. 7205–7211 (2023) 32. Li, T., Pan, Y., Zhu, Q.: Decision-dominant strategic defense against lateral movement for 5g zero-trust multi-domain networks. In: Chen, Y., Wu, J., Yu, P., Wang, X. (eds.) Network Security Empowered by Artificial Intelligence, pp. 25–76. Springer Nature Switzerland, Cham (2024) 33. Li, T., Peng, G., Zhu, Q., Başar, T.: The confluence of networks, games, and learning a game-theoretic framework for multiagent decision making over networks. IEEE Control Systems 42(4), 35–67 (2022) 34. Li, T., Zhao, Y., Zhu, Q.: The role of information structures in game-theoretic multi-agent learning. Annual Reviews in Control 53, 296–314 (2022) 35. Li, T., Zhu, Q.: Agentic AI for cyber resilience: A new security paradigm and its system-theoretic foundations. arXiv preprint arXiv:2512.22883 (2025) 36. Li, T., Zhu, Q.: Symbiotic game and foundation models for cyber deception operations in strategic cyber warfare. In: Foundations of Cyber Deception, pp. 25–62. Springer Cham (2025)
Agentic Incident Response Multiscale Planning
19
37. Lin, X., Zhang, J., Deng, G., Liu, T., Zhang, T., Chen, R., Guo, Q.: IRCOPILOT: Automated incident response with large language models. arXiv:2505.20945 (2025) 38. Loevenich, J.F., Adler, E., Mercier, R., Velazquez, A., Lopes, R.R.F.: Design of an autonomous cyber defence agent using hybrid AI models. In: 2024 International Conference on Military Communication and Information Systems (ICMCIS). vol. 00, pp. 1–10 (2024) 39. Manshaei, M.H., Zhu, Q., Alpcan, T., Başar, T., Hubaux, J.P.: Game theory meets network security and privacy. ACM Comput. Surv. 45(3) (Jul 2013) 40. Miehling, E., Rasouli, M., Teneketzis, D.: A POMDP approach to the dynamic defense of large-scale cyber networks. IEEE Transactions on Information Forensics and Security 13(10), 2490–2505 (2018) 41. Miehling, E., Rasouli, M., Teneketzis, D.: Control-Theoretic Approaches to CyberSecurity, p. 12–28 (2022) 42. Mohammadi, H., Davis, J.J., Kiely, M., Mohammadi, H.: Leveraging large language models for autonomous cyber defense: Insights from CAGE-2 simulations. IEEE Intelligent Systems 40(4), 29–36 (2025) 43. Nguyen, T.T., Reddi, V.J.: Deep reinforcement learning for cyber security. IEEE Transactions on Neural Networks and Learning Systems 34(8), 3779–3795 (2023) 44. OpenAI: GPT-5.5 system card (2026), [Online] Available at https://deployment safety.openai.com/gpt-5-5/gpt-5-5.pdf 45. Pokhrel, A., Katta, V., Colomo-Palacios, R.: Digital twin for cybersecurity incident prediction: A multivocal literature review. In: Proceedings of the IEEE/ACM 42nd International Conference on Software Engineering Workshops. p. 671–678 (2020) 46. Repetto, M.: Cybersecurity digital twins: Concept, blueprint, and challenges for multi-ownership digital service chains. Journal of Information Security and Applications 96, 104299 (2026) 47. Sharafaldin, I., Habibi Lashkari, A., Ghorbani, A.A.: Toward generating a new intrusion detection dataset and intrusion traffic characterization. In: Proceedings of the 4th International Conference on Information Systems Security and Privacy - ICISSP. pp. 108–116 (2018) 48. Strom, B.E., Applebaum, A., Miller, D.P., Nickels, K.C., Pennington, A.G., Thomas, C.B.: MITRE ATT&CK: Design and philosophy. Tech. rep., The MITRE Corporation (2018) 49. Vyas, S., Mavroudis, V., Burnap, P.: Towards the deployment of realistic autonomous cyber network defence: A systematic review. ACM Computing Surveys 58(1), 1–36 (2025) 50. Wang, Z., Shi, T., He, J., Cai, M., Zhang, J., Song, D.: Cybergym: Evaluating AI agents’ real-world cybersecurity capabilities at scale. In: The Fourteenth International Conference on Learning Representations (2026) 51. Wu, X., Farooq, J., Li, T., Chen, J., Wang, Y.: Delay-aware reinforcement learning for o-ran control under stochastic reward feedback. IEEE Networking Letters pp. 1– 1 (2026). https://doi.org/10.1109/LNET.2026.3699505 52. Yan, Y., Zhang, Y., Huang, K.: Depending on yourself when you should: Mentoring LLM with RL agents to become the master in cybersecurity games. arXiv (2024) 53. Zhang, J., Bu, H., Wen, H., Liu, Y., Fei, H., Xi, R., Li, L., Yang, Y., Zhu, H., Meng, D.: When LLMs meet cybersecurity: A systematic literature review. Cybersecurity 8(1), 55 (02 2025)
20
Gao, Y., Li, T., and Hammar, K.
A
Experiment Setup Details
Offline fine-tuning is performed on a Google Cloud virtual machine with 1 Nvidia A100 GPU, and the LoRA hyperparameters are presented in Table 6. The components of our digital twin testbed are summarized in Table 7. Parameter(s)
Value(s)
Host
IP address Service role
LoRA rank, scaling, dropout 64, 128, 0.05 Learning rate 9.5 × 10−4 Per-device batch size 1 Gradient accumulation steps 32 Effective batch size 32 Precision bfloat16
server_ssh 10.0.2.11 OpenSSH service server_samba 10.0.2.12 Samba file sharing server_shellshock 10.0.2.13 Apache CGI service server_web1 10.0.2.14 Nginx and upload service server_web2 10.0.2.15 Nginx and diagnostic service
Table 6: A summary of LoRA fine-tuning hyperparameters.
Table 7: Components of the digital twin.
Attack scenarios. The first scenario, which we refer to as Weak-Credential3, represents a multi-stage attack launched from the client host 10.0.1.11 that eventually takes down three nodes. The attack starts with network reconnaissance and TCP service scanning across the server network. It then compromises server_ssh at 10.0.2.11 through weak SSH credentials, accesses server_samba at 10.0.2.12 through an exposed anonymous SMB share, and exploits the Shellshock-vulnerable CGI service on server_shellshock at 10.0.2.13. The attack also probes the two web servers at 10.0.2.14 and 10.0.2.15. Finally, it uses the compromised SSH server as a pivot to reach other internal services. This scenario mainly compromises the first three servers in Table 7. The second scenario, referred to as Shellshock-4, targets four servers: 10 .0.2.11, 10.0.2.12, 10.0.2.13, and 10.0.2.14. Unlike the first scenario, it avoids a broad ICMP sweep and instead performs targeted service discovery. It uses low-volume SSH password spraying against server_ssh, anonymous SMB share access against server_samba, Shellshock exploitation against server_she llshock, and unauthorized HTTP upload against server_web1. The scenario also includes a pivot from server_shellshock, where commands executed on 10.0.2.13 are used to probe reachable services on the other targeted servers. The last scenario extends the attack coverage to all five servers in the server network, which we refer to as Command-Injection-5. This scenario increases attack techniques diversity by using a) service-specific TCP and HTTP fingerprinting; b) SSH credential reuse with file transfer; c) multi-file SMB staging and rename operations; d) Shellshock command execution; and e) command injection through the diagnostic service on server_web2. In contrast to the previous scenarios, the pivot host is server_web2. After command injection, the attack uses this host to probe reachable services on the other servers. This scenario evaluates the framework under a full five-server compromise with a different pivot point and a broader mixture of service-specific attack evidence.