Autonomous AI Agents for Cloud Security Incident Response Using Large Language Models

Abstract

Cloud computing has become the backbone of modern digital infrastructures; however, its dynamic, distributed, and multi-tenant nature has significantly increased the complexity of cybersecurity incident detection and response. Traditional Security Information and Event Management (SIEM) systems and Security Orchestration, Automation, and Response (SOAR) platforms primarily depend on predefined rules and manual intervention, making them less effective against sophisticated multi-stage cyberattacks and zero-day threats. To address these challenges, this research proposes an Autonomous AI Incident Commander using Large Language Models (AAICR-LLM), a cloud security incident response framework integrating LLMs with autonomous multi-agent collaboration. The architecture combines data ingestion, incident understanding, knowledge management, decision-making, automated response, continuous learning, monitoring, and human supervision. It interprets security events, correlates attacks, and autonomously performs response actions. The framework was evaluated using CICIDS2017, UNSW-NB15, HDFS, Blue Gene/L, and multi-cloud security datasets.

Experimental results demonstrate that the proposed AAICR-LLM framework substantially outperforms conventional cloud security approaches across multiple evaluation metrics. The framework achieved a Detection Accuracy of 99.2%, Precision of 98.9%, Recall of 99.0%, F1-score of 98.9%, Mean Time to Detect (MTTD) of 8 seconds, Mean Time to Respond (MTTR) of 6 minutes, False Positive Rate of 1.1%, and Recovery Success Rate of 99.3%, while maintaining lower CPU and memory utilization than baseline methods. The autonomous collaboration among specialized AI agents significantly accelerated incident handling and minimized manual intervention by achieving an automation rate of 98%. Furthermore, the Continuous Learning Module continuously enhanced detection performance by incorporating operational feedback and newly observed threat intelligence into the knowledge repository. These findings demonstrate that integrating Large Language Models with autonomous AI agents provides a scalable, adaptive, and highly efficient solution for intelligent cloud security incident response, offering improved resilience against evolving cyber threats and reducing operational costs for enterprise cloud infrastructures.