The proposed framework for implementing an AI decision-maker and automation requires an IT specialist to implement it properly, and the AI model’s accuracy depends on the amount of input data.
Abstract
This paper addresses human error in network orchestration systems and the high cost and resource requirements of integrating artificial intelligence (AI) for network orchestration. It proposes a framework for implementing an AI decision-maker and automation. Data are fed into the AI decision-maker to trigger designated automation robots’ tasks or notify IT specialists to gradually implement automated robots, ensuring efficient resource use, reducing costs, and enhancing productivity. We evaluated the proposed method in a simulation with genuinely uncertain outcomes, across 20 independent runs: the AI decision-maker reached 78.3% accuracy against an estimated 79.1% achievable ceiling, and the proposed framework reduced operational cost by 61.4 ± 0.7% relative to fully manual operation—the best of six operating policies in the training environment—while an explicit sensitivity guard, rather than the learned model, accounts for the absence of security incidents; under distribution shift, the framework retains 43.2 ± 0.8% savings, second only to a hand-tuned rule-based router that requires environment-specific threshold calibration. However, the proposed method requires an IT specialist to implement it properly, and the AI model’s accuracy depends on the amount of input data. In the end, we recommend that future work conduct a study focused on AI decision-makers, test the proposed method on real-world companies, and implement AI decision-makers across various departments to cover a broader range of the company’s systems.
Industrial operations increasingly face high-stakes decisions that involve people, data streams, simulations, and control systems. Urgent sessions often require external expertise, retrieval of documents and live telemetry, running what-if simulations, and verifying safety constraints. These scenarios highlight the need for secure interoperability, explainable decision support, and human-in-the-loop control. This paper presents a proposal of a technology-agnostic reference architecture that builds on Industry 4.0 frameworks by incorporating the human-centric, resilient, and sustainable principles of Industry 5.0. Its intelligent layer enables the new approach to human involvement in the process, facilitating meaningful human–machine collaboration. The proposed research provides a practical and conceptual framework for systems engineers, industrial software architects, and operations managers seeking to transition legacy operational plants into human-aligned ecosystems. Its feasibility is evaluated through a simulation-based underground mining testbed, where heterogeneous data sources and communication protocols are integrated into a common operational environment. The proof of concept shows how telemetry, data storage, machine learning models, and operator feedback can be combined to support auditable, explainable, and human-contestable industrial decisions, demonstrating the classification accuracy, remaining useful life forecasting capabilities, and enhanced recommendation precision enabled by iterative operator feedback loops.
Luis Ferreira, E. Gonçalves, G. Putnik et al.· Sustainability· 0 citations
Real-time automation of financial activities, including approvals, controls, routing, and monitoring, can enable fast response to opportunities and threats, eliminating the rotation of capital through liquidity provider balances and streamlining interactions with sources of capital. Generative and agentic AI technologies, supported by real-time data streams of events, market feeds, and key risk indicators, can automate and govern these transactions provided that high standards of latency, throughput, security, and regulatory compliance are achieved. A cloud-native DevOps ecosystem equipped with serverless infrastructure-as-code patterns ensures scalable, cost-effective operations with minimum user interference, allowing a comprehensive evaluation of operational performance, change management, security controls, and regulatory oversight. Scenarios involving AI agents as the driving or supervisory part of automation workflows illustrate the architectural paradigm. The analysis identifies the expected challenges in operational responsibility and response reliability, gathering additional evidence from existing Cloud-Native/Serverless solutions of similar scope. Mitigation strategies address the main issues encountered in every-day AI adoption and propose supporting operations management and security controls. The examination of the full end-to-end process flow, including off-line and real-time phases, ensures cover for Governance, Risk, and Compliance (GRC) objectives by design and the definition of a robust plan for evaluation in on-line use.
E. Campbell· American International Journ...· 0 citations
The authors establish the main issues associated with scalability, security, and maintainability and show future research perspectives of sustainable adoption of RPA in large-scale enterprise settings.
Kenji Sato, Aiko Yamamoto· International Journal of Mod...· 0 citations
Security Operations Centers (SOCs) increasingly rely on Security Orchestration, Automation, and Response (SOAR) platforms to manage high-volume alerts, enrich telemetry, execute playbooks, and shorten incident-response cycles. However, many deployed SOAR systems remain rule dominated: actions are triggered by static if-then playbooks, threshold scores, and analyst-defined routing logic. Such deterministic automation is auditable and operationally useful for known, repetitive events, but it becomes brittle when adversary behavior shifts, telemetry quality varies, alert streams are noisy, assets have unequal business criticality, and compliance constraints differ across response contexts. This paper proposes an Intelligent Security Operations Automation Algorithm (ISOAA) for AI-enabled SOAR. The algorithm integrates probabilistic alert risk scoring, event-graph representation, constrained response optimization, governance-risk-compliance (GRC) gating, human-in-the-loop validation, and feedback-based policy improvement. The mathematical core models each alert as a feature-bearing security object, transforms heterogeneous telemetry into a state representation, estimates actionable incident probability, and selects response actions by maximizing expected security utility subject to operational cost, false-positive loss, and compliance penalty. A rule-based SOAR baseline, an ML-assisted triage baseline, and a reinforcement-learning cyber-response baseline are used for comparative analysis. Controlled benchmark results indicate that ISOAA achieves lower mean time to detect, lower mean time to respond, higher containment success, improved precision and recall, reduced false-positive automation, and lower compliance-breach rate than rule-based SOAR. The paper contributes a defensible mathematical architecture for intelligent SOC automation and offers practical deployment recommendations for risk-aware, auditable, and GRC-constrained response orchestration.
Ikenna Mbuko, O. Ijiga, L. Enyejo· International Journal of Eng...· 0 citations
The findings suggest that combining open-source SIEM, workflow automation, and LLM-based reasoning with human supervision offers a practical, low-cost, and reliable approach for strengthening incident response capability in resource-constrained environments.
Aim/Purpose: The primary objective is to address the structural operational cost crisis in modern SOCs by designing and formally specifying a three-layer agentic AI framework that integrates semantic alert triage, adaptive reinforcement-learning response, and episodic knowledge synthesis into a unified architecture.
Background: Modern SOCs are experiencing an acute operational crisis. Exponential growth in alert volume, high false-positive rates (>40%), and chronic analyst attrition have created a perfect storm. Existing rule-based SIEM and single-agent SOAR approaches only achieve 20–55% alert automation and fail to address the full operational lifecycle.
Methodology: The framework evaluation is based on a structured comparison with seven benchmark systems across four dimensions (threat coverage breadth, integration completeness, cost quantification, and adversarial safeguards), each rated on a five-level ordinal scale using replicable criteria.
Contribution: The paper makes four contributions: (1) a formal algorithmic specification of a three-layer agentic AI architecture including three pseudocode procedures and a PPO state-action-reward formalism; (2) a quantitative operational cost projection framework explicitly distinguishing designed targets from measured performance, with a maximum designed workload reduction of 86%; (3) a systematic four-dimensional comparative analysis against seven benchmark frameworks demonstrating that CyberAgent is the only framework achieving full architectural completeness (integrating all three of semantic triage, adaptive RL response, and episodic knowledge synthesis simultaneously), an architectural claim requiring empirical confirmation; and (4) dual adversarial safeguards (prompt injection mitigation and reasoning consistency verification) absent from all seven benchmark frameworks.
Findings: CyberAgent is a theoretical design-science artefact that has neither been implemented nor empirically evaluated. All quantitative projections are designed to achieve targets grounded in prior work, not verified outcomes: an alert automation rate of 85–90%, an analyst workload reduction of 56–86% (design target 86% under the product-rule independence assumption), an MTTR reduction of 65–75%, and a false-positive reduction of 60–70%. These projections require empirical validation using CybORG and the DARPA OpTC dataset, with this as the primary future work priority.
Recommendations for Practitioners: The PTL’s Chain-of-Thought (CoT) reasoning traces provide human-readable decision narratives that enhance transparency and may support auditability workflows relevant to GDPR Article 33, HIPAA, PCI-DSS, and SOX. However, CoT traces do not automatically satisfy regulatory auditability or compliance requirements; they are one architectural input to a broader compliance process. Formal legal and compliance assessment by qualified professionals is required before deployment in regulated environments. Practitioners should treat CoT output as decision-support documentation, not as regulatory certification.
Recommendation for Researchers: Future work should also develop federated DRL training protocols to ensure policy convergence under data-scarce conditions and rigorously test the adversarial robustness of the PTL’s consistency-checking mechanism against novel prompt-injection strategies.
Impact on Society: If empirically validated, CyberAgent could make enterprise-grade cyber defence more accessible to mid-market organisations that cannot afford 24/7 SOC analyst staffing, by substantially reducing the alert-triage workload. All such impact claims are conditional on validation results.
Future Research: Priority directions include: (1) empirical implementation and red-team validation across diverse enterprise environments; (2) federated DRL training to address the data sharing constraints that limit policy learning in regulated sectors; (3) extension of the KSL to support cross-organizational threat intelligence sharing; and (4) longitudinal studies measuring analyst skill development and human-AI trust calibration under progressively increasing levels of CyberAgent autonomy.
S. Meeampol, Narongsak Sukma· Interdisciplinary Journal of...· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
