LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations

Anes Abdennebi; Nadjia Kara; Laaziz Lahlou; Hakima Ould-Slimane

cs.CRApr 7, 2026

LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations

Authors: Anes Abdennebi, Nadjia Kara, Laaziz Lahlou, Hakima Ould-Slimane

Organizations: Department of Software Engineering and IT, École de Technologie Supérieure (ÉTS), Montreal, Canada · Department of Mathematics & Computer Science, UQTR, Trois-Rivières, Canada

Abstract

Modern Security Operations Centers struggle with alert fatigue, fragmented tooling, and limited cross-source event correlation. Challenges that current Security Information Event Management and Extended Detection and Response systems only partially address through fragmented tools. This paper presents the LLM-assisted network Governance (LanG), an open-source, governance-aware agentic AI platform for unified security operations contributing: (i) a Unified Incident Context Record with a correlation engine (F1 = 87%), (ii) an Agentic AI Orchestrator on LangGraph with human-in-the-loop checkpoints, (iii) an LLM-based Rule Generator finetuned on four base models producing deployable Snort 2/3, Suricata, and YARA rules (average acceptance rate 96.2%), (iv) a Three-Phase Attack Reconstructor combining Louvain community detection, LLM-driven hypothesis generation, and Bayesian scoring (87.5% kill-chain accuracy), and (v) a layered Governance-MCP-Agentic AI-Security architecture where all tools are exposed via the Model Context Protocol, governed by an AI Governance Policy Engine with a two-layer guardrail pipeline (regex + Llama Prompt Guard 2 semantic classifier, achieving 98.1% F1 score with experimental zero false positives). Designed for Managed Security Service Providers, the platform supports multi-tenant isolation, role-based access, and fully local deployment. Finetuned anomaly and threat detectors achieve weighted F1 scores of 99.0% and 91.0%, respectively, in intrusion-detection benchmarks, running inferences in $\approx$ 21 ms with a machine-side mean time to detect of 1.58 s, and the rule generator exceeds 91% deployability on live IDS engines. A systematic comparison against eight SOC platforms confirms that LanG uniquely satisfies multiple industrial capabilities all in one open-source tool, while enforcing selected AI governance policies.

Figures & tables

Acronym	Definition
APT	Advanced Persistent Threat
BYOD	Bring Your Own Device
CVE	Common Vulnerabilities and Exposures
EDR	Endpoint Detection and Response
GPU	Graphics Processing Unit
NIDS	Network Intrusion Detection System

TABLE I : List of Acronyms

Research Area	LanG Contribution
SOC Automation & Alert Fatigue	Agentic AI pipeline with human-in-the-loop checkpoints; replaces rigid SOAR playbooks with LLM-driven reasoning
LLMs & Agentic AI	Governance-constrained multi-node agent with human approval gates
Domain-Specific LLMs	Locally hosted finetuned models for detection, classification, log analysis, and rule generation
IDS Rule Generation	Multi-format finetuned LLMs producing deployable Snort 2/3, Suricata, and YARA rules
Event Correlation	8-hook graph correlation + Louvain clustering + Bayesian scoring
Attack Reconstruction	3-phase pipeline: Scan $\rightarrow$ Correlate $\rightarrow$ Visualize with STIX/PDF export

TABLE II : Positioning of LanG platform relative to key research areas

Panel of Figure 3 — Fig. 1 : LanG platform layered architecture. The Security layer provides guardrails that protect the Agentic AI agents, their capabilities are exposed via MCP tools and resources, and all MCP access is governed by the top-level governance policy. Arrows indicate the dependency direction (bottom-up).

Model	Params	Context	Speciality
Phi-3-mini [ 39 ]	3.8B	4k	Reasoning
CodeLlama-7B [ 25 ]	7B	16k	Code gen.
Mistral-7B [ 40 ]	7B	32k	General
Qwen3-1.7-base [ 99 ]	1.7B	32k	Code gen.

TABLE III : Base Models for Detection Rule Generation. The context length’s unit is number of tokens.

Sub-Record	Key Fields
IoC	type (IP, domain, hash, URL, email, file, CVE, …), value, confidence, source_tool, tags, enrichment
IoA	MITRE technique ID, tactic, subtechnique, evidence, confidence
NetworkFlowMeta	5-tuple (src/dst IP:port, protocol), bytes sent/recv, duration, flags
LogEntry	timestamp, source_tool, host, level, message, parsed fields
AlertCorrelation	alert ID, rule name, severity, matched IoC fingerprints
ThreatFeature	ML model name, label, score, feature vector

TABLE IV : UICR Sub-Record Types and Key Fields

Panel of Figure 6 — Fig. 2 : SOC Agentic Pipeline: five agent nodes with two human-in-the-loop checkpoints. If the alert is classified by Human Review 1 as benign, the pipeline terminates.

Category	Tool / Resource	Description
Detection	detect_anomaly	Run anomaly + threat classification on packet features
Detection	analyze_traffic	Fetch & analyse live PCAP traffic from capture API
Log Analysis	analyze_log	Deep-dive analysis of a SIEM log entry via Ollama
Log Analysis	batch_analyze_logs	Analyse multiple log entries in one call
Threat Intel	query_ioc	Enrich an IoC (IP/domain/hash) via public TI APIs
Threat Intel	correlate_events	Correlate raw events into UICR incidents

TABLE V : MCP Tools and Resources Exposed by the LanG Server

Column	Type	Description
id	INTEGER	Auto-increment primary key
tool_name	TEXT	MCP tool identifier
caller	TEXT	Source (streamlit, mcp_client, …)
status	TEXT	ok, blocked, error
duration_ms	REAL	Execution time in milliseconds
detail	TEXT	Context (e.g., format, error message)

TABLE VI : MCP Audit Log Database Schema

Sub-Policy	Key Fields
AccessRestriction	role, resource_type (mcp_tool, model, agent), resource_name, access_level (deny/read_only/read_write/full), conditions
SecurityPolicy	block_prompt_injection, block_jailbreak, block_role_hijacking, block_system_prompt_extraction, block_model_fingerprinting, block_privilege_escalation, block_self_modification, rate limits, model_protection_rules
ResponsibleAIPolicy	require_decision_explanation, log_all_decisions, disclose_ai_involvement, enable_bias_monitoring, bias_categories, human_review thresholds, escalation_severity
DataPrivacyPolicy	detect_pii (input/output), pii_categories, data_minimization, retention limits, anonymization, external transfer restrictions, encryption_at_rest
IPProtectionPolicy	output_attribution, licence_compliance, provenance_tracking, watermarking, prohibited_use_cases
InterAgentPolicy	allow_delegation, max_depth, delegation_approval, blocked_pairs, scope_inheritance, log_communication

TABLE VII : Governance policy sub-modules and their offered representative fields

Subsystem	Mechanism	Description	Action / Default
Model Protection	System prompt extraction	Blocks attempts to reveal, repeat, or print system instructions	Block
	Architecture probing	Flags queries about model identity, parameters, or layer count	Warn
	Training data extraction	Blocks attempts to reproduce training examples or expose dataset provenance	Block
	Behaviour manipulation	Blocks persistent instruction injection (e.g., “from now on, always…”)	Block
	Capability boundary probing	Logs attempts to discover access to external resources without blocking	Log only
	Custom rules	Per-policy user-defined regex patterns with configurable enforcement actions	Configurable

TABLE VIII : AI Governance and Security Policy Engine — Mechanisms and Configuration

Panel of Figure 11 — Fig. 3 : Governance enforcement architecture of the LanG platform. Left: MCP tool invocation flow, the governance policy engine evaluates the caller’s role against AccessRestriction rules. Unmatched requests are denied by default and logged to the policy violations table for SOC analysts review. Top right: The three enforcement points, tool invocation, sanitization, and agent pipeline layers, through which governance checks are applied before any LLM call is made. Bottom right: Policy lifecycle management with draft $\,\to\,$ active $\,\to\,$ archived transitions.

Panel of Figure 12 — Fig. 4 : MSSP deployment topology. The central LanG instance serves multiple client databases through the MCP server. Analysts (Operator role) access assigned clients, Admins have full visibility.

Format	Train	Val	Test
Suricata	17,571	2,196	2,196
Snort 2	9,428	1,179	1,179
Snort 3	9,428	1,179	1,179
Yara	6,429	803	803
Total	42,856	5,357	5,357

TABLE IX : Rule Generation Dataset Statistics

Panel of Figure 14 — Fig. 5 : Syntactic validity rate (%) by model and rule format on the held-out test set ( $n{=}5{,}357$ ). All models exceed 88% across every format, Qwen3-1.7-base achieves the highest average (93.5%).

Model	Final Loss	Best Val Loss	Time (s)	Params %
Phi-3-mini	0.58	0.48	4803.15	1.12
CodeLlama-7B	0.45	0.40	8539.65	0.68
Mistral-7B	0.40	0.38	8912.43	0.71
Qwen3-1.7-base	0.61	0.43	3561.29	0.65

TABLE X : Training Metrics for Rule Generation Models

Format	Tested	Accepted	Rate (%)
Snort 2	200	170 / 180 / 191 / 194	85.0 / 90.0 / 95.5 / 97.0
Snort 3	200	186 / 186 / 198 / 197	93.0 / 93.0 / 99.0 / 98.5
Suricata	200	152 / 179 / 188 / 182	76.0 / 89.5 / 94.0 / 91.0
Sub-overall	600	508 / 545 / 577 / 573	84.7 / 90.8 / 96.2 / 95.5
Yara	200	77 / 157 / 142 / 149	38.5 / 78.5 / 71.0 / 74.5
Overall	800	585 / 702 / 719 / 722	73.1 / 87.8 / 89.9 / 90.2

TABLE XI : Deployment Acceptance Rate by Rule Format and Target Tool. Each rule was generated from a held-out test prompt by Phi-3-mini-4k-Instruct / Qwen3-1.7-base / Codellama-7b / Mistral-7b finetuned adapters, then tested individually against the native engine in configuration-check mode.

Format	Error Category	Count
Snort 2	Malformed option argument	30	0	0	0
	Invalid port specification	0	18	9	6
	Unsupported protocol	0	2	0	0
Snort 3	Malformed option argument	14	0	0	0
Snort 3	Invalid port specification	0	14	2	3
Suricata	Empty/Unparseable rule structure	48	21	12	18

TABLE XII : Top Rejection Categories per Format (Deployment Validation,

n\!=\!200

per format) for all finetuned models in the following order ( Phi-3-mini-4k-Instruct / Qwen3-1.7-base / Codellama-7b / Mistral-7b )

Panel of Figure 18 — Fig. 6 : Ablation: effect of the RulePostProcessor on syntactic validity rate. Post-processing improves validity by 3.2–5.1 percentage points, with the largest gain on Phi-3-mini.

	Correlation			Reconstructor
Scenario	Prec.	Rec.	F1	Chain	Bayes.
	(%)	(%)	(%)	Acc. (%)	Score
BruteForce	91.0	88.0	89.0	91	0.82
Exfiltration	87.0	84.0	86.0	86	0.78
WebProtocols	93.0	90.0	91.0	94	0.85
RemoteSysDiscovery	85.0	82.0	83.0	82	0.71

TABLE XIII : Correlation Engine Grouping and Attack Reconstructor Performance

Node	Model / Backend	Type	Latency	Quality
N1 — Ingest & Guardrail Scan		Events
N1	Guardrail pipeline	300	5.0 ms	—
N2 — Classify Threat (finetuned)		Event		Acc
N2	LanG-NetSentinel (binary)	200	13.5 ms	99.0%
N2	LanG-ThreatGuard (10-class)	200	12.4 ms	91.0%
N2	LanG-SecLlama (multi-class)	200	21.1 ms	95.0%

TABLE XIV : Agentic Pipeline Per-Node Latency and Output Quality

Model	$N$	T1	T2	T3	T4	T5 $\dagger$	$T_{\mathrm{auto}}$	$T_{\mathrm{machine}}$
		(ms)	(ms)	(ms)	(ms)	(s)	(ms)	(s)
LanG-NetSentinel	1,000	5.00	0.54	12.14	3.97	1.56	21.66	1.58
LanG-ThreatGuard	4,999	5.01	0.49	12.02	3.14	1.56	20.66	1.58

TABLE XV : Phase-Decomposed MTTD per Model (Measured T1–T5)

Model	$N$	Acc.	F1 mac	F1 wtd	$T_{\mathrm{auto}}$	$T_{\mathrm{machine}}$
		(%)	(%)	(%)	(ms)	(s)
LanG-NetSentinel	1,000	99.0	99.0	99.0	21.7	1.58
LanG-ThreatGuard	4,999	91.0	41.3	91.0	20.7	1.58

TABLE XVI : Detection Performance and Machine-Side MTTD

Category	Direction	$N$	Expected
Adversarial (should be detected)
Prompt injection	Input	60	Block
Encoded payload	Input	20	Warn / Block
Role manipulation	Input	16	Warn
Dangerous command	Output	20	Block
Credential leak	Output	20	Warn

TABLE XVII : Guardrail Benchmark Corpus Composition

Panel of Figure 24 — Fig. 7 : Guardrail recall per adversarial category: Layer 1 (regex only) vs. Layer 1 + 2 (regex + Llama Prompt Guard 2 semantic classifier). The semantic guard raises prompt-injection recall from 76.7% to 93.3% and aggregate recall from 90.1% to 96.3%. Precision is 100.0% for both configurations. FP $\,=\,0$ (block-level) across all 70 benign samples, mean scan latency $\approx$ 39 ms for L2-routed inputs.

Panel of Figure 25 — Fig. 8 : Reconstruction time vs. number of input events. Phase 2 plateaus beyond top- $N{=}100$ , confirming quadratic complexity.

Feature	LanG	Splunk SOAR	XSOAR	MS Sentinel	Elastic Security	TheHive	Wazuh	Shuffle	MISP
Agentic AI pipeline	✓	$\triangle^{a}$	$\triangle^{a}$	$\triangle^{b}$	$\triangle^{a}$	—	—	—	—
Human-in-the-loop checkpoints	✓	✓	✓	✓	—	$\triangle^{c}$	—	$\triangle^{d}$	$\triangle^{e}$
LLM-driven rule generation	✓	—	—	—	—	—	—	—	—
Multi-format rules (Snort/Suricata/Yara)	✓	—	—	—	$\triangle^{f}$	—	—	—	$\triangle^{g}$
UICR unified data structure	✓	$\triangle^{h}$	$\triangle^{i}$	$\triangle^{j}$	—	—	—	—	—
Attack scenario reconstruction	✓	—	$\triangle^{k}$	$\triangle^{l}$	—	—	—	—	—

TABLE XVIII : Feature Comparison of LanG with Existing SOC Platforms and Tools

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 27 — Fig. 9 : Simplified attack graph for the brute-force-to-exfiltration scenario. Nodes represent kill-chain phases with associated MITRE ATT&CK techniques, edges denote the dominant correlation hook.

Fig. 10 : Example attack scenario visualization generated by Phase 3. Nodes are labelled by kill-chain phase (e.g., reconnaissance, exploitation, C2). Edge thickness reflects composite correlation weight.

Fig. 11 : Example of a reconstructed cyberattack scenario after being flagged then acted against (through a newly generated rule).

Fig. 12 : Example of agentic AI flow for anomaly & threat detection, log analysis, and new detection rule generation of a malicious DoS traffic being captured by our platform’s AI agents, and awaiting for the analyst’s review (approval, modification, discard) [First checkpoint].

Fig. 13 : Example of a threat path where the threat detection agent communicates with the rule generation agent, then awaiting for the analyst’s review (approval, modification, discard) [Second checkpoint].

Fig. 14 : Example of a the generated rules using one of the finetuned models (Qwen3-1.7-base).

Fig. 15 : Example of a complete agentic pipeline flow of a detected threat and generated then deployed its respective detection rule.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification
Jul 13, 2026SingGuard TeamLLM Guardrails AI Agent Security
AI Security Lab, Ant Group
SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center
Sep 3, 2026Uday Vallabhaneni, Cassie L. Cagwin, David J. WildReinforcement Learning Cybersecurity
Luddy School of Informatics, Computing and Engineering · Indiana University, Bloomington, IN, USA
LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance
Feb 27, 2026Chuanming Tang, Ling Qing, Shifeng ChenAutonomous Cyber Defense Multi-Agent Systems
Shenzhen Institute of Advanced Technology, CAS · Sangfor Technologies Inc. · College of Management Science +2

Jul 13, 2026J/K move · Enter open · S save

SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification

SingGuard Team

AI Security Lab, Ant Group

LLM Guardrails AI Agent Security AI Agent Security Benchmarks Safety Filtering

Open paper AskPDF arXiv

We present nsfaguard, a guardrail framework for securing agentic AI systems against operational threats, such as prompt injection, sensitive information extraction, malicious code requests, dangerous tool misuse, and resource exhaustion. We first introduce the NSFA taxonomy, which organizes 185 risk variants into a CIA-triad-grounded hierarchy and is cross-validated against three well-established OWASP guidelines. Based on this taxonomy, we construct a benchmark suite spanning 133 languages, comprising over 93K purpose-built samples targeting both user queries and agent responses, along with 3,435 cross-source samples adapted from five public agent-security datasets. To detect these operational threats in practice, we develop a dual-mode approach combining SFT-based generative reasoning for interpretable offline auditing with discriminative classification heads on the frozen backbone, enabling real-time detection at approximately 50,ms. We release four models with 0.8B, 2B, 4B, and 9B parameters, all achieving

\geq

94% F1 on purpose-built benchmarks and surpassing the strongest competing guardrails by 6 to 12 absolute points. On cross-source evaluation, the 9B model attains 91.29% F1 with a more balanced precision--recall trade-off. Moreover, ablation experiments show that classification heads can equip a guardrail with risk detection capabilities beyond its original scope and achieve state-of-the-art performance. These results demonstrate the extensibility of the approach and its generality as a plug-in enhancement.

Abstract

Cybersecurity

Explore similar work

SingGuard-NSFA: Extensible Guardrails for Agentic AI via Generative Reasoning and Real-Time Classification

SENTINEL-RL: Offloading Topological Reasoning from LLM Agents in the Security Operations Center

LiaisonAgent: An Multi-Agent Framework for Autonomous Risk Investigation and Governance