论文提出AIDA多智能体框架改进SOC告警分诊

1. 12:00
   arXiv · Multiagent Systems

   从调查失败到可靠 SOC 智能体：理解并改进基于 LLM 的告警分流

   论文构建 ALERT-BENCH 交互基准，在实时 SIEM 中回放企业遥测，要求系统检索证据并处理 1,247 条多阶段攻击告警。五种代表性方法均漏掉至少 40.4% 的攻击相关告警，追踪分析显示搜索无记录、同上下文复核净纠偏为负、关闭告警的调查强度不高于升级。

Current heat 9·Comparable peak 10（Oct 9）·Comparable change over 24 hours –

The trend compares only the same participants observed continuously; its range may be smaller than the current heat count. Move or click on the chart to inspect hourly heat; use the left and right arrow keys to switch.