Authors: Assistant Professor J.Vanitha, Assistant Professor K.Karthika
Abstract: In light of the increasing sophistication and speed of cyberattacks in today's environment, it has become apparent that traditional signature-based detection approaches and manual incident handling processes are lacking. In this paper, we introduce a framework for autonomous cybersecurity based on generative artificial intelligence which combines synthetic threat intelligence via large language models with automated response guided by reinforcement learning. The framework is based on three tightly coupled layers: a threat intelligence semantic layer, which consumes diverse compromise indicators and outputs structured and enriched threat narratives, a reasoning layer that correlates multistream telemetry data using MITRE ATT&CK techniques and formulates incident hypotheses, and an action layer, which implements containment and remediation playbooks with human-in-the-loop control. We describe the system architecture, algorithmic flow, and simulation-based evaluation of the framework in a number of representative enterprise-scale cyberattack scenarios. Evaluation results show that the framework decreases the mean time to triage and response while keeping the false-positive escalation rate at a bounded level through confidence-guided action selection. Comparing our approach to baseline rule-based and reinforcement learning solutions demonstrates its practicality.
