STAIR：基于端到端智能体规划框架的高效事件响应

View PDF HTML (experimental)

Abstract:Incident response planning is critical for restoring compromised software systems. Existing AIOps methods automate fault diagnosis and remediation and adapt response using feedback, but lack a unified decision basis across planning and execution. This limits their ability to maintain incident state and align actions with evolving recovery objectives during long-horizon, multi-stage security incident response. We present STAIR, an end-to-end agentic response framework that organizes planning and execution around a shared incident state. STAIR maintains incident evidence, response actions, and execution feedback in Graph-as-State (GAS), using the latest state to determine the response stage and recovery objectives for stage-specialized planning. The framework retrieves effect-validated historical experience based on the current state and stage to guide action selection. An Execution Harness executes actions, returns feedback to update GAS, and validates action effects for future experience reuse. We construct STAIR-Bench, an executable incident response benchmark comprising 44 Docker-based cyber-range cases. On its held-out test cases, STAIR achieves an overall defense score of 0.95, improving over the strongest baseline by approximately 10.47%. In the independent CAGE4 environment with ongoing attacks and benign activity, STAIR reduces cumulative penalties by approximately 28.8% relative to the strongest baseline.

Submission history

From: Hanlin Jiang [view email]
[v1] Mon, 10 Aug 2026 12:25:12 UTC (809 KB)
[v2] Fri, 9 Oct 2026 08:48:42 UTC (562 KB)