BlueSTAR tiers LLM agents for IT/OT defence

Problem

The paper studies autonomous cyber defence for enterprise IT/OT networks where attacks are increasingly automated and can outpace human analysts. Large language models offer flexible reasoning across heterogeneous signals but cannot be applied directly to raw security telemetry because logs arrive at packet volume, single events are ambiguous, and unconstrained model actions risk harmful operational disruption. The work addresses how to build an autonomous decision layer that is timely, safe, and effective against both well-known and novel intrusion techniques.

Approach

BlueSTAR is a tiered agentic architecture combining a deterministic reactive tier with an LLM-based reasoning tier and a signal extraction layer that converts high-volume telemetry into compact indicators of compromise aggregated by actor and target. Precision detectors produce binary IOCs for fast deterministic remediation, while a Suspicious Event Detector emits natural-language context consumed by the LLM. A rolling memory preserves open indicators, prior actions and rationales across detection cycles so the reasoning tier can perform cross-cycle correlation and escalate when reactive actions fail. The system was evaluated on two live IT/OT cyber ranges running full Active Directory and distinct SCADA/PLC systems across seven attack chains based on real techniques, measuring continuous resilience with a newly proposed Res-AUC metric that integrates attacker reach, mission impact and defender collateral.

Key Findings

• Signal grounding is essential: feeding raw SIEM logs to LLMs is structurally infeasible because model throughput cannot match ingest, precision collapses, and costs become prohibitive; compressing telemetry into actor-resolved IOCs enables practical LLM use.
• Tiered design preserves fast containment: the deterministic tier provides bounded-latency, predictable responses and continues to operate if the LLM is unavailable, retaining fast containment for attacks with unambiguous indicators.
• LLM reasoning closes gaps deterministic rules cannot: the LLM tier acts on ambiguous behavioural signals and across cycles to detect credential theft, repeated compromise and concurrent attackers that the deterministic tier misses.
• Cross-cycle memory matters: recording prior actions and open threats lets the LLM escalate (for example to credential rotation or account blocks) when session termination repeatedly fails, preventing re-entry on stolen credentials.
• Agent-agnostic resilience metric: Res-AUC samples defender and attacker state continuously and penalises disruptive collateral, enabling fair comparison between rule-based and LLM-driven defenders on live infrastructure.
• Empirical transfer: the architecture transferred without modification to a second range with different topology and OT protocol, containing OT-impacting attacks in the evaluated scenarios.
• Safety benefit: the grounded LLM issued far fewer, more precise actions than a raw-LLM setup, which produced many dangerous self-targeting actions and low precision.

Limitations

Evaluation excludes adversaries that adapt their technique in response to observed defender behaviour and does not explore environments with substantially different IT foundations than Active Directory. Some Res-AUC parameters are hand-set and the defender must still hand off certain high-impact remediation decisions to human operators when safe automated remediation is not available.

Implications

Offensively, the results indicate defenders that lack actor-level aggregation and cross-cycle memory can be evaded by credential harvesting and quiet, concurrent campaigns: attackers that extract durable credentials or operate beneath categorical detectors can persist and re-enter repeatedly. The tiered design shows that automating escalation to credential rotation or blocking network-logon types is decisive in denying reuse of harvested credentials. The necessity of signal extraction suggests that adversaries might target or poison aggregation layers to impair LLM reasoning, and that rapid, machine-speed credential theft remains a high-value technique against defenders that do not perform actor-level correlation.