Heyi Wang

Security Operations Centers (SOCs) face increasing pressure from alert fatigue and complex incident response requirements across heterogeneous production environments. While Large Language Models (LLMs) show promise in automating security workflows, their deployment in production settings raises significant concerns about safety, auditability, and controlled execution. We present SecOps-Agent, a policy-grounded framework that leverages LLMs for security incident response while maintaining strict operational controls. Our approach introduces a Policy Grounding Engine that validates all LLM-generated response plans against role-based access control (RBAC) policies, predefined playbooks mapped to MITRE ATT&CK techniques, and change management windows before execution. The framework enforces a whitelist-only action model with mandatory dry-run validation and generates comprehensive audit trails linking all actions to supporting evidence. Experimental evaluation on a composite dataset of WAF alerts, Kubernetes audit logs, and cloud security events demonstrates that SecOps-Agent reduces Mean Time to Respond (MTTR) by 47.3% compared to traditional SOAR automation while maintaining a false action rate below 5%. Our results indicate that policy-grounded LLM agents can provide meaningful automation benefits in security operations while preserving the auditability and control requirements essential for production environments.

This study focuses on optimizing cache strategies in backend systems and proposes an adaptive cache eviction mechanism based on deep reinforcement learning. Traditional algorithms often struggle with complex and dynamic access patterns. They lack state awareness and the ability to evolve their policies. To address these limitations, this study models cache management as a Markov Decision Process and introduces Deep Q-Networks (DQN) as the decision-making core. An agent is built to learn the optimal actions under different cache states. The model extracts key features such as cache hit rate, access frequency, and time intervals through state representation. It uses experience replay and a target network to ensure stable training. The method is evaluated in several typical experimental scenarios, including hot and cold data switching, changes in cache capacity, and dynamic request distributions. In all cases, the method shows strong adaptability and stability in metrics such as hit rate, response time, and eviction efficiency. The experimental results show that the method effectively improves cache utilization and reduces system latency. It also demonstrates the ability to continuously learn and adjust policies in complex environments. The study provides a systematic evaluation from three perspectives: method modeling, system implementation, and experimental analysis. It confirms the feasibility and practical value of applying deep reinforcement learning to backend cache management. This work offers technical support for intelligent cache optimization in highly dynamic service environments.