Ph.D. Candidate: İsa Cem Eken
Program: Information Systems
Date: 03.09.2026 / 15:00
Place: A-108

Abstract: In our modern digital world, security threats are a significant problem for every individual, organization, and government. To assist security personnel with orchestration and automation efforts in Security Operation Centres (SOCs), novel approaches regarding the support of artificial intelligence are required. This study proposes a cyber resilience orchestration framework whose scope is derived from the National Institute of Standards and Technology (NIST) and the literature. The framework uses Large Language Models (LLMs) for automation, orchestration, and collaboration with security personnel. It is observed that strong LLMs with large context sizes perform well in resilience orchestration. The implementation of an automation readiness level (ARL) logic introduced controlled human intervention into the orchestration flow. In end-to-end playbook execution experiments, both with and without ARL scores, GPT-4o achieved a full score (100%) on expected actions, following GPT-4 Turbo with over 90% scores. This study also examines the Application Programming Interface (API) recommendation, which is an essential facilitator in the integration processes required for orchestration. Single endpoint prediction and end-to-end API recommendation, including correct request schema and curl command creation experiments were conducted. 100% endpoint prediction success with Retrieval Augmented Generation (RAG), and 87.5% end-to-end API recommendation success after detecting the correct endpoint with the LLM Agent was achieved.