SENTINEL‑RL for SOCs: Architectural Gains and Cost Realities from Decoupling Semantic and Topological Reasoning

说明与用途

SENTINEL‑RL 将 SOC 中的语义注释与拓扑策略解耦，提升吞吐量并降低工程师工作量，同时保持计算线性。

问题

Legacy SOC platforms entangle semantic reasoning and graph traversal, causing throughput bottlenecks, high human effort, and runaway costs in large‑scale authentication investigations.

结果

SENTINEL‑RL increased throughput from 4.7 to 18.2 graphs/minute, reduced engineering interventions from 3.2 to 0.7, and lowered CPU hours from 8.5 to 2.1, at the cost of modest LLM API spend (≈$17.35/run).

工作流

• 1. Ingest raw authentication events.
• 2. SemanticAgent annotates each event using an embedding model, producing a suspicious flag per node.
• 3. TopologyAgent receives only semantic tags and applies an RL or heuristic policy to select action nodes based on graph degree.
• 4. Message bus passes lightweight annotations between pipelines.
• 5. Actions are executed or escalated to human analysts.

证据

Legacy SOAR GPU Hours 0, CPU‑Hours 8.5, Mean Engr. Interventions 3.2, Graphs/Minute 4.7; SENTINEL‑RL GPU Hours 0.12, CPU‑Hours 2.1, Mean Engr. Interventions 0.7, Graphs/Minute 18.2

来源

[2024-06-11T14:52:22.561Z][INFO] Initiating subgraph walk for alert_id=a7f... [2024-06-11T14:52:22.880Z][WARN] Context reload triggered at depth=7, edge=(host_9,host_18)

来源