Skip to content

AgenticCyber: A GenAI-Powered Multi-Agent System for Multimodal Threat Detection and Adaptive Response in Cybersecurity

🕒 Published (v1): 2025-12-06 10:59 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

AgenticCyber is a LangChain-orchestrated multi-agent system that fuses cloud logs, surveillance video, and environmental audio through a Gemini-powered orchestrator to detect and remediate cyber threats in real time. It achieves 96.2% F1-score and 420 ms end-to-end latency, reducing MTTR by 65% over rule-based baselines. The system combines classical ML (isolation forests, autoencoders, GMMs) for local scoring with attention-based fusion and Q-learning for adaptive response selection.

Problem

Traditional SOC tooling is siloed — log analyzers, computer vision systems, and audio classifiers operate independently, causing fragmented threat correlation, high false-positive rates (up to 90%), and slow response (MTTR > 200 hours per Verizon 2024 DBIR). No prior framework concurrently fuses structured cloud telemetry, unstructured video, and ambient audio with agentic autonomy for cross-modal threat reasoning.

Method

Five specialized agents are chained via LangChain: Log Agent (Isolation Forest + Gemini over AWS CloudTrail), Vision Agent (autoencoder anomaly scoring + Gemini vision on UCF-Crime frames), Audio Agent (YAMNet labels + GMM + Gemini reasoning over UrbanSound8K), Orchestrator Agent, and Responder Agent. Streams are synchronized through Apache Kafka. Each modality agent returns a tuple \(\langle s_m, e_m \rangle\) where \(s_m \in [0,1]\) is a local threat score and \(e_m\) is a natural-language explanation. The Orchestrator fuses scores via scaled dot-product attention:

\[f_{\text{score}} = \text{softmax}\!\left(\frac{QK^T}{\sqrt{d_k}}\right)V, \quad Q = W_Q \cdot [s_{\log}; s_{\text{video}}; s_{\text{audio}}]\]

If \(f_{\text{score}} > \theta = 0.7\), Gemini 1.5 Pro generates a threat hypothesis modeled as a POMDP state; the Responder selects a remediation action via Q-learning. Threat events are correlated in a Neo4j graph using MITRE ATT&CK tactics as structure. Genetic algorithms evolve Gemini few-shot prompt templates over time.

Key Contributions

  • Modular four-layer architecture (perception → analysis → orchestration → response) combining per-modality classical ML with GenAI reasoning.
  • Attention-based multimodal fusion that dynamically weights modality contributions rather than averaging, preventing low-confidence signals from diluting high-fidelity ones.
  • POMDP + Q-learning response policy that balances threat mitigation against operational disruption, with history tracking for state context.
  • End-to-end evaluation on AWS CloudTrail (1.9M events), UCF-Crime (1,100 frames), and UrbanSound8K (300 clips) with synthetic multimodal alignment (15,000 instances).

Results

  • 96.2% F1-score vs. Snort (78.1%), UniModal CNN-LSTM (81.1%), Static MAS (85.3%).
  • 420 ms end-to-end latency vs. 800 ms (Static MAS), 950 ms (UniModal CNN-LSTM), 1200 ms (Snort) — a 65% improvement.
  • Situational Awareness Score (SAS) 0.92 vs. 0.65–0.78 for baselines.
  • 42% false-positive reduction over unimodal baselines in ambiguous cross-modal scenarios.
  • 92% Adaptive Efficacy (AE); 85% of simulated APTs (reconnaissance, exfiltration) auto-mitigated.
  • Ablation: removing Gemini fusion drops F1 by 30% and increases latency by 40%.
  • Qualitative explanation quality: 4.6/5 on a Likert scale.

Limitations

  • Gemini API costs and external cloud dependency are an acknowledged barrier to edge/IoT deployment.
  • Evaluation uses small, sampled subsets (2,000 logs, 1,100 frames, 300 clips) from public datasets; real SOC volumes are orders of magnitude larger.
  • Privacy risks from audio/video processing are noted but only proposed mitigations (federated learning) are cited, not implemented.
  • LLM reasoning bias acknowledged; SHAP/debiasing mentioned but not empirically evaluated.
  • No ablation of the POMDP/Q-learning component in isolation; it is unclear how much of the gain comes from fusion vs. the response policy.
  • Synthetic multimodal alignment (temporal pairing of heterogeneous datasets) may not reflect real attack correlation distributions.

Relevance to Harnesses / Meta-Harnesses

AgenticCyber is a domain-specific multi-agent harness that exemplifies the pattern of orchestrating specialized sub-agents through a centralized orchestrator with dynamic prompt construction and inter-agent chaining via LangChain — the same architectural concern at the core of general-purpose meta-harnesses. The three-phase algorithm (distributed perception → attention fusion → GenAI reasoning + policy execution) is a concrete instantiation of the scout-fuse-act meta-harness pattern applied to a high-stakes real-time domain. The use of genetic algorithms to evolve few-shot prompt templates at runtime is a self-adaptive harness mechanism directly relevant to harnesses that must tune agent behavior without manual intervention. The explicit POMDP formulation for action selection introduces a formal decision-theoretic layer into the harness control loop that is rarely articulated in general-purpose orchestration frameworks.