Security Operations Centers (SOCs) rely on Level 1 analysts to triage increasing alert volumes amid alert fatigue and tool fragmentation. LLM-based multi-agent systems using the Model Context Protocol (MCP) are being adopted to automate these tasks, but their autonomy and tool access expose them to attacks such as tool poisoning, indirect prompt injection, and confused deputy exploitation. To address this gap, this work proposes a security framework for MCP-based multi-agent SOC pipelines, implemented as a middleware layer comprising a tool registration validator and five execution layers: access control, rate limiting, input validation, output validation, and audit logging. The framework is applied to a triage-enrichment-response pipeline connected to a Wazuh SIEM through a custom MCP server. Of the 35 attack vectors considered in a threat model derived from different threat taxonomies, including OWASP, MITRE ATLAS, and ATFAA, 29 are addressable at the middleware level and are covered by the framework’s controls. These controls are then validated experimentally using a purpose-built malicious MCP server and targeted test-harness injections, organized into six test suites that together exercise the covered vectors across 600 executions. Every attack instance in the evaluated threat model was blocked, none bypassed the framework, and no legitimate call in the evaluated set was incorrectly rejected; obfuscated variants, however, evade the lexical content-inspection controls, delimiting the scope of this result. A full-pipeline demonstration confirms that the framework preserves benign operational outputs. These results indicate that systematic middleware controls can secure MCP-based agentic SOC deployments without modifying the underlying agents or MCP servers.
R. Simões, Xavier Larriva-Novo, Carmen Sánchez-Zas et al.· Applied Sciences· 0 citations
Intrusion Detection Systems (IDSs) based on traditional machine learning treat network flows as independent tabular samples, ignoring the relational and topological structure that characterizes modern distributed attacks. Graph Neural Networks (GNNs) overcome this limitation by modeling network topology, which in turn raise the need to make their predictions transparent. This work develops and compares traditional classifiers against a GNN-based IDS on the UNSW-NB15 dataset, for both binary and multiclass classification. A novel graph construction is proposed in which each node is an individual flow and edges are defined by temporal proximity through three complementary strategies (conversation chains and temporal k-NN by source and destination IP). Three GNN backbones—GraphSAGE, Graph Convolutional Network (GCN) and Graph Attention Network (GAT)—are trained under an identical, matched pipeline and a chronological, inductive evaluation protocol, so that any difference is attributable to the backbone alone. A two-stage classifier then separates detection from attack-type categorisation, with GNNExplainer providing interpretability, and SHAP applied to the traditional models. In binary classification, GraphSAGE achieves an Accuracy of 0.9906, Precision of 0.9856, Recall of 0.9998, F1-Score of 0.9927 and ROC-AUC of 0.9965, exceeding the traditional baselines in their conventional evaluation setting, while GCN and GAT reach comparable detection (F1 ≈ 0.99), showing that the temporal graph rather than the specific backbone drives detection. The explainability analysis identifies TTL-related and connection-state variables as dominant predictors and reveals attack-specific structural patterns, confirming that temporally structured GNNs improve detection while providing interpretable predictions.
Alberto Caballero Ferrero, Shadi Motaali, Xavier Larriva-Novo et al.· Electronics· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
