Incident response subsystem controls alerts with rules and local ai
Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model
Cryptography and SecuritySoftware Engineering
Summary
Handling alerts after security or system incidents can be complicated and slow. The authors present a system that uses clear rules and a local AI model to decide how serious an alert is and suggest what to do next, while keeping humans in control. Their tests showed the system works correctly, keeps track of actions, can recover from problems, and keeps AI use predictable. This helps manage alerts in education IT systems more efficiently.
What this means in practice
- •For information security teams: Manage and automate response to system alerts using rules and local AI models for consistent, traceable incident handling.
- •For educational it administrators: Control and streamline alert follow-up in educational systems by combining deterministic rules and AI advisory with human oversight.
Authors
Hoang-Lam Huynh, Quoc-Cuong Tang, Van-Tri Phan, Khuong Nguyen-An
Abstract
This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the playbook, while Static RAG and a local large language model provide advisory content under Validator, Guardrail, Output Sanitizer, and Safe Fallback controls. Experiments begin after simulated alerts are stored in Elasticsearch. The Rule Engine matched the predefined routing matrix in all 30 boundary cases. The Durable Queue completed 100 events without duplicate tasks, new failed tasks, or unintended firewall rules. An eight-alert contention experiment preserved the configured limit of one active model request, and 30 sequential measurements showed an overall mean post-alert processing time of approximately 33 seconds. The results demonstrate functional correctness, traceability, controlled recovery, and bounded model integration within the evaluated laboratory scope.