LanG 2.0: Energy-Efficient Agentic AI for Semi-Automated Security Operations at Scale

Anes Abdennebi; Nadjia Kara; Laaziz Lahlou; Hakima Ould-Slimane

cs.AIOct 29, 2026

LanG 2.0: Energy-Efficient Agentic AI for Semi-Automated Security Operations at Scale

Authors: Anes Abdennebi, Nadjia Kara, Laaziz Lahlou, Hakima Ould-Slimane

Organizations: Department of Software Engineering and IT, École de technologie supérieure (ÉTS), Montreal, QC, Canada · Department of Mathematics and Computer Science, Université du Québec à Trois-Rivières (UQTR), Trois-Rivières, QC, Canada

Abstract

Security operations centers (SOCs) need to turn terabytes of alerts, logs and flows into trusted, affordable decisions to unveil hidden threats. We present LanG 2.0, an agentic system that detects threats, correlates evidence and writes rules, investigating whether small local models can replace frontier models affordably and safely when structural safeguards, not model accuracy, provide the guarantees. It incorporates entity-anchored correlation, human approval of rule changes and a tamper-evident ledger. Tests span eight flow datasets from five networks, real XDR alerts and multistage campaigns. Against its predecessor, campaign correlation precision rises from 18.75% to 51.81%, and rule acceptance from at most 60.00% to 98.33%. Against Claude Opus 5.5, scoring flows against each network's normal traffic detects attacks on unseen networks at 73.42% F1 without false positives, versus 58.10% with 49.00% false positives, for at least 650 times less energy. Finetuned models statistically match it on alert classification and rule writing for 5.6 to 59 times less energy. The work demonstrates LanG's practical scalability, processing 3.33 million records in 6.4 minutes, over 30 million hourly, and its safeguards resisted prompt injection, label poisoning and ledger tampering, so small local models can carry most SOC detection affordably and safely.

Figures & tables

Work	Input data	Multisource	Output	Explanation	Energy report	Budget	Core technique
Alert2Vec [ 3 ]	network, host alerts	partial	threat levels	–	–	–	alert subgraph embedding
GraphWeaver [ 4 ]	XDR alerts	partial	incidents	–	–	–	shared entities, spanning tree
MuSAR [ 5 ]	alarms, application logs	✓	attack chains	–	–	–	ATT&CK stage linking
Carbon Filter [ 24 ]	EDR alerts	–	false alert clusters	–	–	–	similarity hashing
KAIROS [ 6 ]	kernel audit	–	summary graph	–	–	–	temporal GNN
ORTHRUS [ 7 ]	kernel audit	–	attack paths	–	–	–	GNN, dependency analysis

TABLE I: Comparison of LanG with representative correlation, investigation, response, rule generation and accounting approaches.

Symbol	Meaning	Symbol	Meaning
Events and correlation (Sections III to IV-C )
$e$ , $E$	event (Eq. ( 1 )), set	$C$	attack campaign
$\rho$ , $\rho_{p}$	process, parent process	$\tau$ , $\sigma$	ATT&CK tactics, severity
$I$ , $A$	indicators, ATT&CK techniques	$c$	command line
$q$	event confidence (Eq. ( 2 ))	$E_{N}$	primary set of $N$ events
$h_{k}$	hook $k$ (Table III )	$\mathcal{H}_{E}$ , $\mathcal{H}_{C}$	entity, context hooks

TABLE II: Notation, grouped by the section that defines each symbol.

Hook	Class	Weight rule
Temporal	C	$\exp(-3\Delta t/W)$ for $\Delta t\leq W$ ( $W=300$ s)
IP linkage	E	1.0 shared address, 0.8 NAT pivot ( $\mathit{ip}_{s}\!=\!\mathit{ip}_{d}^{\prime}$ ), 0.7 same /24
Host cooccurrence	E	0.85 same host within 120 s, 0.4 same host otherwise
Flow pattern	C	protocol 0.3, destination port 0.4 (0.15 if within 100), source port 0.2, volume ratio above 0.8 adds 0.1
IoC overlap	E	$\min(1,0.3\,\|I_{i}\cap I_{j}\|)$
Kill chain	C	phase distance rule (0.8, 1.0, 0.6, decaying)

TABLE III: Correlation hooks. Hooks marked E are entity hooks and may anchor an edge. Hooks marked C are context hooks.

Panel of Figure 4 — Fig. 1: Agentic execution plane as an execution trace. Columns are agent graph steps, lanes the principal in control. Orange stations call a model, blue ones are deterministic. The analyst reviews the classification and the rules, and decides at the dashed third checkpoint on rules an engine rejects. Only the deployment agent (padlock) writes rules. Model inputs and outputs cross a guardrail (violet), every action is appended to the hash chained ledger, and energy accrues only at model calls.

	Benchmark B					GUIDE
	$\eta=0$				$\eta=1$	one day			7 days
Method	P	R	F1	NI	F1	P	R	F1	F1
Time window	18.80	99.88	31.17	0.00	31.13	42.68	48.57	28.82	59.78
IP only	99.67	44.83	60.12	99.65	42.12	84.38	59.87	60.41	71.58
Entity union	39.06	83.33	45.42	29.32	30.77	41.68	85.47	45.70	41.81
Hub-pruned union	42.10	78.77	48.21	47.48	40.82	46.08	82.53	47.43	44.10

TABLE IV: Correlation quality (B 3 , %, attack events). Benchmark B: mean over 12 cells of

M

, benign volume and

\phi

(30 seeds each), without (

\eta=0

) and with (

\eta=1

) a shared egress address. GUIDE: 50 one-day and 20 seven-day windows. NI: noise isolation.

Panel of Figure 6 — Fig. 2: Detection on unseen networks. (a) Trees trained on other NetFlow datasets (bars: eight feature variants) are near or below chance (dashed) except on ToN-IoT, unlike trees trained on the same dataset and the label-free site baseline. (b, c) Label-free detectors at 1% false alarms, means over 40 runs with 95% intervals.

	No labels from the network			Family macro F1 (%)
Dataset (export)	AUC	Detected %	False al. %	$n{=}0$	$200$	$1000$
UNSW-NB15 (NF)	0.997	92.48	0.88	6.94	51.01	50.89
UNSW-NB15 (CIC)	0.914	35.61	1.13	9.24	47.29	51.93
ToN-IoT (NF)	0.881	8.54	1.10	4.17	79.82	85.71
ToN-IoT (CIC)	0.896	5.13	1.22	3.83	46.29	53.75
BoT-IoT (NF)	0.968	87.71	1.31	8.51	88.48	90.09

TABLE V: Detector on each dataset as an unseen network. Left: with 5,000 normal flows only, AUC, attacks detected and benign flows flagged (%) at 1.00% target false alarms. Right: family macro F1 with

n

analyst labels. NF, CIC, NTL: NetFlow v3, CICFlowMeter, NTLFlowLyzer.

System	P	R	F1	FPR	Family	Wh per flow
LanG, unseen network	100.00	58.00	73.42	0.00	4.50	$4.9{\times}10^{-7}$ and $9.3{\times}10^{-5}$
LanG, adapted	91.95	80.00	85.56	7.00	62.57
LanG, same dataset	98.84	85.00	91.40	1.00	71.32
Claude Opus 5.5	55.45	61.00	58.10	49.00	43.26	0.24 to 0.34
Qwen 2.5 7B	0.00	0.00	0.00	1.00	0.00	0.026
Llama 3.2 3B	0.00	0.00	0.00	0.00	2.28	0.015

TABLE VI: Detection and family naming on 200 flows of four networks (%) and energy per flow (LanG batched and per call, frontier published, inference only, training in Table VII ). The frontier prompt differed from the local one. Section V-G compares naming under one protocol.

Panel of Figure 9 — Fig. 3: Rule generation on 240 held-out incidents: replayable incidents detected (84, or 62 without Sigma for the previous work) against energy per rule. The open circle is the loop with the YARA repair. Table S2 of the supplement gives acceptance, indicator recall and latency.

Panel of Figure 10 — Fig. 4: Macro F1 of the detection phase agents on the items the frontier model answered (397 alerts, 250 incidents, 217 flows), with 95% intervals. Classical: TF-IDF with logistic regression (alerts), LightGBM (incidents, flows). Table S3 of the supplement lists all values.

Operation	Unit	LanG	Frontier
Inference
Flow detector, batches (CPU)	flow	$4.9{\times}10^{-7}$ [ $3.7{\times}10^{-6}$ ]	0.24 to 0.34
Flow detector, one call (CPU)	flow	$9.3{\times}10^{-5}$ [ $3.6{\times}10^{-4}$ ]	0.24 to 0.34
Classical agents (CPU)	alert, flow	[about $10^{-5}$ ]	0.24 to 0.34
Alert analyst, 4B	alert	0.0137	0.24 to 0.34
Incident grader, 1.7B	incident	0.0058	0.24 to 0.34

TABLE VII: Energy per unit of work (Wh). GPU:

E_{\mathrm{tot}}

(Eq. ( 7 )), with idle draw. CPU: utilization model [bound at 190 W]. Frontier: published, inference only. Item: one alert, incident or flow answered in one request.

Panel of Figure 12 — Fig. S1: Architecture of LanG. Orange blocks invoke a language model, metered by the carbon plane (green), and blue blocks are deterministic.

Panel of Figure 13 — Fig. S2: Measurement hierarchy of the carbon plane and derivation of an emission record.

Panel of Figure 14 — Fig. S3: Emissions of the same analysis run (22.37 Wh total) under the grid factors of ten regions from the LanG table.

Panel of Figure 15 — Fig. S4: Graph construction and community detection time versus the size of the primary set (six corpora, no model calls).

Panel of Figure 16 — Fig. S5: Autonomous subsystems. A front stage turns millions of records into ranked work units, each subsystem runs the agent graph (Fig. 1 of the paper) on its top units with a policy at the checkpoints, and rules wait in buckets for an analyst. Counts from Section V-C of the paper.

	Flows	Logs
Records	2,365,424	965,067
Suspects after the filter	143,073	57,041
Attack records kept by the filter	92.69%	68.37%
Incidents, work units	6, 238	57,041, 577
Front stage time, throughput	51.5 s, 45,957/s	18.2 s, 52,822/s
Workflows run (failed), policy decisions	25 (0), 50	25 (0), 50

TABLE S1: Two autonomous subsystems on 3.33 million records. Attack shares use labels the subsystems never read.

Local models finetuned for rule generation (previous work in 4 bits)
System	Acc.	Det.	Recall	Wh per rule	p50 (s)
LanG v2 + loop, 16 bits	98.33	82.14	98.41	0.128	3.37 †
LanG v2 + loop, 8 bits	97.50	79.76	98.37	0.047	1.00 †
LanG v2, 8 bits, one attempt	95.00	82.14	98.41	0.043	0.78
Previous work [ 4 ] , Qwen3 1.7B ∗	60.00	29.03	73.86	0.169	7.00
Previous work [ 4 ] , Mistral 7B ∗	57.50	29.03	79.25	0.352	9.81

TABLE S2: Rule generation on 240 held out incidents (%), the values of Fig. 3 of the paper. Acc.: rules the engine loads. Det.: the 84 replayable incidents detected. Recall: given indicators used. “+ loop”: validator loop, at most three attempts.

	Alert step		Incident grade		Flow family
System	Sub.	All	Sub.	All	Sub.	All
LanG finetuned	97.31	90.75	42.83	40.95	12.14	16.27
base size	4B		1.7B		8B
Claude Opus 5.5	95.19		27.24		26.78
gpt-oss-20b	53.64		30.07		14.78
Classical	98.32	93.10	43.41	42.16	12.24	12.58

TABLE S3: Macro F1 (%) of the detection phase agents (Fig. 4 of the paper) on unseen organizations and networks. Sub.: items the frontier model answered (397, 250, 217). All: whole test set (10,297, 3,000, 5,495), run for the finetuned and classical systems only (Section V-G of the paper explains the empty cells). Classical: TF-IDF with logistic regression (alerts), LightGBM (others). 95% intervals in the text.

Agent	Base	F1	Frontier	Gain	kWh	Decision
Alert analyst	1.7B	85.10	89.76		0.136	escalate
(109 alerts)	4B	89.63	89.76	4.53	0.272	escalate
	8B	72.97	89.76	$-16.66$	0.429	keep 4B
Incident grader	1.7B	55.13	29.40		0.141	keep
(30 incidents)
Family namer	1.7B	17.52	52.61		0.130	escalate

TABLE S4: Escalation ladder: validation macro F1 (%) on items the frontier model also answered, and training energy. A larger base is tried only if the agent trails the frontier model and its last step gained at least two points.

		Macro F1 [95% CI]
Network	Flows	Finetuned 8B	LightGBM
UNSW-NB15	2,535	9.20 [8.34, 10.11]	11.43 [10.52, 12.42]
ToN-IoT	2,405	19.20 [17.88, 20.69]	10.06 [9.25, 10.97]
CSE-CIC-IDS2018	1,059	15.65 [14.19, 17.37]	13.65 [12.21, 15.07]
All (distinct flows)	5,495	16.27 [15.35, 17.26]	12.58 [11.92, 13.23]

TABLE S5: Family namer on each test network, absent from the training of both systems. Macro F1 (%) with its 95% confidence interval (CI) over flows.

	Pattern layer	With Prompt Guard 2
	% [95% CI]
Texts	flagged	flagged	quarantined
BIPIA instructions (150)	0.00 [0.00, 2.43]	0.67 [0.12, 3.68]	0.00 [0.00, 2.43]
BIPIA in log lines (150)	0.00 [0.00, 2.43]	0.67 [0.12, 3.68]	0.00 [0.00, 2.43]
deepset injections (263)	5.32 [3.20, 8.74]	26.24 [21.29, 31.87]	19.39 [15.07, 24.60]
deepset benign (399)	0.00 [0.00, 0.92]	0.25 [0.04, 1.41]	0.00 [0.00, 0.92]

TABLE S6: Input filters on published injections and benign text, each passed through the production quarantine as one log message. Share flagged, and quarantined (never seen by a model), in % with 95% confidence interval (CI). Pattern layer: 0.1 ms per field. Prompt Guard 2: about 10 ms more on the GPU.

Configuration	Flagged	lower	higher	lower	changed	Benign
		Severity		Priority	Log risk
No filter	0.00	15.00	25.00	0.00	47.50	0 of 30
Pattern filter	0.00	30.00	20.00	2.50	55.00	0 of 30
Prompt Guard 2, spotlighting	0.00	37.50	30.00	10.00	55.00	0 of 30
Benign text control	0.00	32.50	30.00	7.50	45.00	0 of 30
Clean rerun	n/a	10.00	32.50	0.00	57.50	n/a

TABLE S7: Injection in complete workflows: 40 AIT incidents (30 attacks, 10 benign), one BIPIA attack each in a user agent or log line. Changes against the same incident without attack, in % of 40 workflows. Clean rerun: identical clean prompts run twice. Benign: attack incidents graded benign. All workflows reached the analyst.

Labels	FPR	Det.	Fam. F1	Named	Alerted	Gate	Audit
Clean	2.57	89.24	61.01	80.97	92.86	9	n/a
Targeted, $\epsilon=2\%$	2.56	83.57	59.38	70.12	84.87	8	70.83
Targeted, $\epsilon=5\%$	2.64	78.53	56.53	55.95	75.59	7	66.11
Targeted, $\epsilon=10\%$	2.31	73.00	53.74	38.34	68.07	10	63.89
Targeted, $\epsilon=20\%$	1.82	69.00	43.51	10.97	64.12	12	65.00
Availability, $\epsilon=2\%$	2.47	88.40	60.34	78.68	91.24	12	0.00

TABLE S8: Poisoned feedback, mean of 12 runs (four NetFlow data sets, three baseline draws), in %. FPR and Det.: alerts on benign and attack flows. Fam. F1: naming of detected attacks. Named, Alerted: targeted family flows named correctly, alerted. Gate: adaptations accepted (of 12). Audit: poisoned labels sent to a second analyst. Without labels: FPR 1.08, Det. 59.48, Fam. F1 0.86, Named 2.26, Alerted 63.54.

	Without key		With HMAC key
Attack	chain	anchor	chain	anchor
Edit one record	200	200	200	200
Delete one record	200	200	200	200
Truncate 1, 10 or 100 records	0	200	0	200
Forge a record after the head	0	0	200	200
Swap two records	200	200	200	200

TABLE S9: Ledger tampering: trials detected of 200 per attack, by the chain alone and against an anchor taken before the attack.

Fix	Metric	Before	After
Greedy decoding, fixed seed	severity changed, clean rerun	42.50	0.00
	log risk changed, clean rerun	57.50	25.00
50 site labels (family namer)	F1, three new networks	12.31	55.07
200 site labels			67.08
frontier names as labels			23.33
10 labels per organization	F1, 17 GUIDE organizations	28.25	69.53

TABLE S10: Targeted improvements, before and after (%). F1 is macro F1 except for correlation (B 3 F1). Means over five draws for the label experiments.

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 368 papers

LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations
Apr 7, 2026Anes Abdennebi, Nadjia Kara, Laaziz Lahlou +1Cybersecurity LLMs for Cybersecurity
Department of Software Engineering and IT, École de Technologie Supérieure (ÉTS), Montreal, Canada · Department of Mathematics & Computer Science, UQTR, Trois-Rivières, Canada
Cybersecurity Detection Classification with Reasoning-enabled Language Models
Jul 30, 2026Amol Khanna, Manu Nandan, Cristian Viorel Popa +10CoT Reasoning Language Model Calibration
CrowdStrike
Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps
Apr 21, 2026Alankrit Chona, Igor Kozlov, Ambuj KumarAI Agent Security Benchmarks LLMs for Cybersecurity
Simbian AI

Apr 7, 2026J/K move · Enter open · S save

LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations

Anes Abdennebi, Nadjia Kara, Laaziz Lahlou, Hakima Ould-Slimane

Department of Software Engineering and IT, École de Technologie Supérieure (ÉTS), Montreal, Canada · Department of Mathematics & Computer Science, UQTR, Trois-Rivières, Canada

Cybersecurity LLMs for Cybersecurity AI Agent Security AI Agent Governance Network Intrusion Detection

Open paper AskPDF arXiv

Modern Security Operations Centers struggle with alert fatigue, fragmented tooling, and limited cross-source event correlation. Challenges that current Security Information Event Management and Extended Detection and Response systems only partially address through fragmented tools. This paper presents the LLM-assisted network Governance (LanG), an open-source, governance-aware agentic AI platform for unified security operations contributing: (i) a Unified Incident Context Record with a correlation engine (F1 = 87%), (ii) an Agentic AI Orchestrator on LangGraph with human-in-the-loop checkpoints, (iii) an LLM-based Rule Generator finetuned on four base models producing deployable Snort 2/3, Suricata, and YARA rules (average acceptance rate 96.2%), (iv) a Three-Phase Attack Reconstructor combining Louvain community detection, LLM-driven hypothesis generation, and Bayesian scoring (87.5% kill-chain accuracy), and (v) a layered Governance-MCP-Agentic AI-Security architecture where all tools are exposed via the Model Context Protocol, governed by an AI Governance Policy Engine with a two-layer guardrail pipeline (regex + Llama Prompt Guard 2 semantic classifier, achieving 98.1% F1 score with experimental zero false positives). Designed for Managed Security Service Providers, the platform supports multi-tenant isolation, role-based access, and fully local deployment. Finetuned anomaly and threat detectors achieve weighted F1 scores of 99.0% and 91.0%, respectively, in intrusion-detection benchmarks, running inferences in

\approx

21 ms with a machine-side mean time to detect of 1.58 s, and the rule generator exceeds 91% deployability on live IDS engines. A systematic comparison against eight SOC platforms confirms that LanG uniquely satisfies multiple industrial capabilities all in one open-source tool, while enforcing selected AI governance policies.

Abstract

Cybersecurity

Explore similar work

LanG -- A Governance-Aware Agentic AI Platform for Unified Security Operations

Cybersecurity Detection Classification with Reasoning-enabled Language Models

Cyber Defense Benchmark: Agentic Threat Hunting Evaluation for LLMs in SecOps