A Knowledge-Based Multi-Agent Framework for Security Control Recommendation

🕒 Published (v1): 2026-07-10 20:18 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper proposes a Security Decision Support System (DSS) that recommends minimal NIST SP 800-53 rev5 security control sub-families by modeling the selection problem as a non-zero-sum simultaneous game over 7 security dimension agents, solved via no-regret online learning on a Multi-Agent Influence Diagram (MAID). It bypasses the PPAD-complete intractability of exact Nash equilibria, achieving 99% satisfaction coverage using ~65% of SW-implementable controls in under 36 seconds.

Problem

IT teams hardening on-premises environments lack the cybersecurity expertise to select, prioritize, and optimize security controls from large abstract catalogues (e.g., 300 active NIST SP 800-53 rev5 sub-families). Existing approaches either evaluate controls from a single perspective (expert judgment, threat mitigation, or SW-implementability) or model cybersecurity decisions via two-player game-theoretic frameworks with small control sets, leaving a gap in scalable, knowledge-integrated multi-dimensional recommendation.

Method

The system operates as a three-block pipeline (Fig. 1): dataset curation → MAID construction → game-theoretic recommendation.

Dataset (DS8): A unified dataset of 300 Security and Privacy Control Sub-Families (SPCSFs) with 38 columns is constructed by left-joining 7 sources: NIST OSCAL catalogue (DS1), expert survey scores (DS2), CSF mappings (DS3), LLM-generated security dimension coverage scores via Gemini 2.5 Pro (DS4), STRIDE-LM threat mappings (DS5), SW-implementability taxonomy (DS6), and MITRE ATT&CK mitigation metrics (DS7). Three partial scores (expert, STRIDE-LM ratio, ATT&CK average) are aggregated into a total score \(p_i \cdot \text{avg}(\text{scoreDS2}, \text{scoreDS5}, \text{scoreDS7})\), where \(p_i = 1\) iff at least one SW-implementability indicator is set.

MAID: A Multi-Agent Influence Diagram extends classical Bayesian Networks by encoding per-SPCSF coverage of 7 security dimensions (C, I, A, authenticity, accountability, non-repudiation, privacy) and total scores as a Knowledge Graph with probabilistic influences across random variable nodes.

Game: A non-zero-sum, simultaneous game with 7 agents (one per security dimension) explores the joint action space over SPCSFs. No-regret online learning (rather than exact Nash/Stackelberg/subgame-perfect equilibria) finds approximate optimal joint profiles, avoiding PPAD-complete complexity. The recommender then uses the best-joint-profile upper bound to maximally satisfy coverage requirements while minimizing over-provisioning.

Key Contributions

• Curated unified dataset DS8: 300 SPCSFs × 38 columns integrating InfoSec, academic, and LLM-interpreted sources with derived partial and total scores
• MAID-based Knowledge Graph encoding probabilistic coverage relationships across 7 security dimensions
• Scalable 7-agent non-zero-sum game using no-regret online learning, replacing intractable exact equilibrium computation
• Security DSS pipeline: from raw user requirements to ranked, minimal SPCSF recommendations with under- and over-provisioning minimization

Results

• 99% satisfaction coverage using ~65% of SW-implementable SPCSFs; runtime 1.2–35.7 seconds
• 73–77% satisfaction coverage using ~29% of controls; runtime 0.8–13.8 seconds
• Validated across varying dataset sizes for performance and accuracy
• Baselines: prior works limited to 2-player games with small control sets or Monte Carlo sampling; no direct numerical baseline is reported against a competing system — evaluation is primarily internal (coverage vs. resource usage trade-off)

Limitations

• Security dimension coverage scores in DS4 are LLM-generated (Gemini 2.5 Pro) rather than expert-validated; the paper explicitly notes operational deployments should replace these with expert-curated values
• No-regret learning yields approximate equilibria, not exact optimal solutions
• Dataset restricted to NIST SP 800-53 rev5; ISO/IEC 27002 and MITRE D3FEND not integrated
• Evaluation lacks comparison against a competing recommendation system baseline; coverage metrics are self-referential against the same dataset
• Scalability beyond 7 agents and broader catalogues is not empirically evaluated
• KG is rebuilt from scratch at each execution rather than incrementally updated

Relevance to Harnesses / Meta-Harnesses

This paper instantiates a structured multi-agent harness in which a fixed set of agents (security dimensions) is orchestrated by a game-theoretic coordinator rather than by a central controller, making it an example of a knowledge-grounded, non-hierarchical meta-harness pattern. The three-stage pipeline (dataset curation → KG/MAID construction → game solving → recommendation) mirrors harness design concerns: data ingestion, structured knowledge encoding, multi-agent coordination, and output synthesis. The use of no-regret online learning as the coordination mechanism — replacing exact solvers — is directly analogous to harness-level decisions about when to substitute expensive exact methods with scalable approximate ones. For researchers tracking harnesses, this work is notable as a case study where the harness's coordination layer (the game solver) is explicitly designed around computational tractability constraints of the agent population.