A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy

• URL: http://arxiv.org/abs/2505.23397v2
• Date: Sun, 01 Jun 2025 03:54:31 GMT
• Title: A Unified Framework for Human AI Collaboration in Security Operations Centers with Trusted Autonomy
• Abstract summary: This article presents a structured framework for Human-AI collaboration in Security Operations Centers (SOCs)<n>We propose a novel autonomy tiered framework grounded in five levels of AI autonomy from manual to fully autonomous.<n>This enables adaptive and explainable AI integration across core SOC functions, including monitoring, protection, threat detection, alert triage, and incident response.
• Score: 10.85035493967822
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: This article presents a structured framework for Human-AI collaboration in Security Operations Centers (SOCs), integrating AI autonomy, trust calibration, and Human-in-the-loop decision making. Existing frameworks in SOCs often focus narrowly on automation, lacking systematic structures to manage human oversight, trust calibration, and scalable autonomy with AI. Many assume static or binary autonomy settings, failing to account for the varied complexity, criticality, and risk across SOC tasks considering Humans and AI collaboration. To address these limitations, we propose a novel autonomy tiered framework grounded in five levels of AI autonomy from manual to fully autonomous, mapped to Human-in-the-Loop (HITL) roles and task-specific trust thresholds. This enables adaptive and explainable AI integration across core SOC functions, including monitoring, protection, threat detection, alert triage, and incident response. The proposed framework differentiates itself from previous research by creating formal connections between autonomy, trust, and HITL across various SOC levels, which allows for adaptive task distribution according to operational complexity and associated risks. The framework is exemplified through a simulated cyber range that features the cybersecurity AI-Avatar, a fine-tuned LLM-based SOC assistant. The AI-Avatar case study illustrates human-AI collaboration for SOC tasks, reducing alert fatigue, enhancing response coordination, and strategically calibrating trust. This research systematically presents both the theoretical and practical aspects and feasibility of designing next-generation cognitive SOCs that leverage AI not to replace but to enhance human decision-making.

Related papers

• Agentic AI for Safety-critical Multi-drone Systems: Challenges and Opportunities [38.499036085412094]
  Multi-drone systems are increasingly positioned for safety-critical missions such as search and rescue (SAR) and critical infrastructure monitoring.<n>Yet, real-world adoption remains constrained not only by autonomy performance, but by the difficulty of integrating agentic behavior into professional work.<n>This position paper synthesizes the ambitions and lessons from two ongoing efforts: NAMUR and PERSIST.
  arXiv  Detail & Related papers  (2026-08-19T11:53:02Z)
• Solipsistic Superintelligence is Unlikely to be Cooperative [48.65947679109806]
  We argue that superintelligence, an extremely capable task solver, is unlikely to be cooperative.<n>We call for a non-solipsistic research paradigm that treats interdependence as a core design principle.
  arXiv  Detail & Related papers  (2026-06-02T06:54:55Z)
• Safety in Embodied AI: A Survey of Risks, Attacks, and Defenses [168.50301366360344]
  Embodied Artificial Intelligence (Embodied AI) integrates perception, cognition, planning, and interaction into agents that operate in safety-critical environments.<n>Unlike digital AI systems, embodied agents must act under uncertain sensing, incomplete knowledge, and dynamic human-robot interactions.<n>This survey provides a comprehensive review of safety research in embodied AI, examining attacks and defenses across the full embodied pipeline.
  arXiv  Detail & Related papers  (2026-03-28T13:21:44Z)
• From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agents [36.1914922430313]
  We present a taxonomy of threats spanning cognitive manipulation, physical environment disruption, and multi-agent systemic failures.<n>The findings aim to guide the development of multilayered, autonomy-aware defense architectures for trustworthy AI agent systems.
  arXiv  Detail & Related papers  (2026-03-08T06:45:28Z)
• Cognition to Control - Multi-Agent Learning for Human-Humanoid Collaborative Transport [36.304887250687536]
  This paper introduces cognition-to-control (C2C), a three-layer hierarchy that makes the deliberation-to-control pathway explicit.<n> Experiments on collaborative manipulation tasks show higher success and robustness than single-agent and end-to-end baselines.
  arXiv  Detail & Related papers  (2026-03-04T06:24:55Z)
• Agentic AI for Cybersecurity: A Meta-Cognitive Architecture for Governable Autonomy [0.0]
  This paper argues that cybersecurity orchestration should be reconceptualized as an agentic, multi-agent cognitive system.<n>We introduce a conceptual framework in which heterogeneous AI agents responsible for detection, hypothesis formation, contextual interpretation, explanation, and governance are coordinated through an explicit meta-cognitive judgement function.<n>Our contribution is to make this cognitive structure architecturally explicit and governable by embedding meta-cognitive judgement as a first-class system function.
  arXiv  Detail & Related papers  (2026-02-12T12:52:49Z)
• Human Society-Inspired Approaches to Agentic AI Security: The 4C Framework [19.576189199576053]
  This article introduces the 4C Framework for multi-agent AI security, inspired by societal governance.<n>By shifting AI security from a narrow focus on system-centric protection to the broader preservation of behavioral integrity and intent, the framework complements existing AI security strategies.
  arXiv  Detail & Related papers  (2026-02-02T10:45:16Z)
• Conformity and Social Impact on AI Agents [42.04722694386303]
  This study examines conformity, the tendency to align with group opinions under social pressure, in large multimodal language models functioning as AI agents.<n>Our experiments reveal that AI agents exhibit a systematic conformity bias, aligned with Social Impact Theory, showing sensitivity to group size, unanimity, task difficulty, and source characteristics.<n>These findings reveal fundamental security vulnerabilities in AI agent decision-making that could enable malicious manipulation, misinformation campaigns, and bias propagation in multi-agent systems.
  arXiv  Detail & Related papers  (2026-01-08T21:16:28Z)
• Managing Ambiguity: A Proof of Concept of Human-AI Symbiotic Sense-making based on Quantum-Inspired Cognitive Mechanism of Rogue Variable Detection [39.146761527401424]
  The study contributes to management theory by reframing ambiguity as a first-class construct.<n>It demonstrates the practical value of human-AI symbiosis for organizational resilience in VUCA environments.
  arXiv  Detail & Related papers  (2025-12-17T11:23:18Z)
• AURA: An Agent Autonomy Risk Assessment Framework [0.0]
  AURA (Agent aUtonomy Risk Assessment) is a unified framework designed to detect, quantify, and mitigate risks arising from agentic AI.<n>AURA provides an interactive process to score, evaluate and mitigate the risks of running one or multiple AI Agents, synchronously or asynchronously.<n>AURA supports a responsible and transparent adoption of agentic AI and provides robust risk detection and mitigation while balancing computational resources.
  arXiv  Detail & Related papers  (2025-10-17T15:30:29Z)
• From Agentification to Self-Evolving Agentic AI for Wireless Networks: Concepts, Approaches, and Future Research Directions [70.72279728350763]
  Self-evolving agentic artificial intelligence (AI) offers a new paradigm for future wireless systems.<n>Unlike static AI models, self-evolving agents embed an autonomous evolution cycle that updates models, tools, and in response to environmental dynamics.<n>This paper presents a comprehensive overview of self-evolving agentic AI, highlighting its layered architecture, life cycle, and key techniques.
  arXiv  Detail & Related papers  (2025-10-07T05:45:25Z)
• A cybersecurity AI agent selection and decision support framework [0.0]
  This paper presents a novel, structured decision support framework that aligns AI agent architectures, reactive, cognitive, hybrid, and learning.<n>By integrating agent theory with industry guidelines, this framework provides a transparent and stepwise methodology for selecting and deploying AI solutions.
  arXiv  Detail & Related papers  (2025-10-02T07:38:21Z)
• Agentic Services Computing [51.50424046053763]
  We propose Agentic Services Computing, a paradigm that reimagines services as autonomous, adaptive, and collaborative agents.<n>We organize ASC around a four-phase lifecycle: Design, Deployment, Operation, and Evolution.
  arXiv  Detail & Related papers  (2025-09-29T07:29:18Z)
• DeCoDe: Defer-and-Complement Decision-Making via Decoupled Concept Bottleneck Models [37.118479480792416]
  We propose a concept-driven framework for human-AI collaboration.<n>DeCoDe makes strategy decisions based on human-interpretable concept representations.<n>It supports three modes: autonomous AI prediction, deferral to humans, and human-AI collaborative complementarity.
  arXiv  Detail & Related papers  (2025-05-25T16:34:45Z)
• A Task-Driven Human-AI Collaboration: When to Automate, When to Collaborate, When to Challenge [16.734679201317896]
  We show how proper human-AI integration maintains meaningful agency while improving performance.<n>This framework lays the foundation for practically effective and morally sound human-AI collaboration.
  arXiv  Detail & Related papers  (2025-05-23T23:19:15Z)
• Internet of Agents: Fundamentals, Applications, and Challenges [66.44234034282421]
  We introduce the Internet of Agents (IoA) as a foundational framework that enables seamless interconnection, dynamic discovery, and collaborative orchestration among heterogeneous agents at scale.<n>We analyze the key operational enablers of IoA, including capability notification and discovery, adaptive communication protocols, dynamic task matching, consensus and conflict-resolution mechanisms, and incentive models.
  arXiv  Detail & Related papers  (2025-05-12T02:04:37Z)
• Towards AI-Driven Human-Machine Co-Teaming for Adaptive and Agile Cyber Security Operation Centers [3.959615037146599]
  Security Operations Centers (SOCs) face growing challenges in managing cybersecurity threats due to an overwhelming volume of alerts, a shortage of skilled analysts, and poorly integrated tools.<n>We introduce an AI-driven human-machine co-teaming paradigm that leverages large language models (LLMs) to enhance threat intelligence, alert triage, and incident response.<n>We present a vision in which LLM-based AI agents learn from human analysts the tacit knowledge embedded in SOC operations, enabling the AI agents to improve their performance on SOC tasks through this co-teaming.
  arXiv  Detail & Related papers  (2025-05-09T19:38:26Z)
• Perceptions of Agentic AI in Organizations: Implications for Responsible AI and ROI [0.0]
  This paper investigates how organizations perceive and adapt such frameworks amidst the emerging landscape of agentic AI.<n>Findings highlight that the inherent complexity of agentic AI systems and their responsible implementation, rooted in the intricate interconnectedness of responsible AI dimensions and the thematic framework, contribute to significant challenges in organizational adaptation.
  arXiv  Detail & Related papers  (2025-04-15T19:15:06Z)
• Do LLMs trust AI regulation? Emerging behaviour of game-theoretic LLM agents [61.132523071109354]
  This paper investigates the interplay between AI developers, regulators and users, modelling their strategic choices under different regulatory scenarios.<n>Our research identifies emerging behaviours of strategic AI agents, which tend to adopt more "pessimistic" stances than pure game-theoretic agents.
  arXiv  Detail & Related papers  (2025-04-11T15:41:21Z)
• Human-AI Collaboration in Cloud Security: Cognitive Hierarchy-Driven Deep Reinforcement Learning [7.370441344885935]
  Security Operations Centers (SOCs) must adopt AI-driven adaptive defense mechanisms to counter Advanced Persistent Threats (APTs)<n>We propose a Cognitive Hierarchy Theory-driven Deep Q-Network (CHT-DQN) framework that models interactive decision-making between SOC analysts and AI-driven APT bots.<n>Our framework enhances adaptive SOC defense using Attack Graph (AG)-based reinforcement learning.
  arXiv  Detail & Related papers  (2025-02-22T03:19:21Z)
• Position: Emergent Machina Sapiens Urge Rethinking Multi-Agent Paradigms [8.177915265718703]
  We argue that AI agents should be empowered to adjust their objectives dynamically.<n>We call for a shift toward the emergent, self-organizing, and context-aware nature of these multi-agentic AI systems.
  arXiv  Detail & Related papers  (2025-02-05T22:20:15Z)
• Causal Responsibility Attribution for Human-AI Collaboration [62.474732677086855]
  This paper presents a causal framework using Structural Causal Models (SCMs) to systematically attribute responsibility in human-AI systems. Two case studies illustrate the framework's adaptability in diverse human-AI collaboration scenarios.
  arXiv  Detail & Related papers  (2024-11-05T17:17:45Z)
• Combining AI Control Systems and Human Decision Support via Robustness and Criticality [53.10194953873209]
  We extend a methodology for adversarial explanations (AE) to state-of-the-art reinforcement learning frameworks. We show that the learned AI control system demonstrates robustness against adversarial tampering. In a training / learning framework, this technology can improve both the AI's decisions and explanations through human interaction.
  arXiv  Detail & Related papers  (2024-07-03T15:38:57Z)
• Quantifying AI Vulnerabilities: A Synthesis of Complexity, Dynamical Systems, and Game Theory [0.0]
  We propose a novel approach that introduces three metrics: System Complexity Index (SCI), Lyapunov Exponent for AI Stability (LEAIS), and Nash Equilibrium Robustness (NER) SCI quantifies the inherent complexity of an AI system, LEAIS captures its stability and sensitivity to perturbations, and NER evaluates its strategic robustness against adversarial manipulation.
  arXiv  Detail & Related papers  (2024-04-07T07:05:59Z)
• Autonomous Open-Ended Learning of Tasks with Non-Stationary Interdependencies [64.0476282000118]
  Intrinsic motivations have proven to generate a task-agnostic signal to properly allocate the training time amongst goals. While the majority of works in the field of intrinsically motivated open-ended learning focus on scenarios where goals are independent from each other, only few of them studied the autonomous acquisition of interdependent tasks. In particular, we first deepen the analysis of a previous system, showing the importance of incorporating information about the relationships between tasks at a higher level of the architecture. Then we introduce H-GRAIL, a new system that extends the previous one by adding a new learning layer to store the autonomously acquired sequences
  arXiv  Detail & Related papers  (2022-05-16T10:43:01Z)
• Watch-And-Help: A Challenge for Social Perception and Human-AI Collaboration [116.28433607265573]
  We introduce Watch-And-Help (WAH), a challenge for testing social intelligence in AI agents. In WAH, an AI agent needs to help a human-like agent perform a complex household task efficiently. We build VirtualHome-Social, a multi-agent household environment, and provide a benchmark including both planning and learning based baselines.
  arXiv  Detail & Related papers  (2020-10-19T21:48:31Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.