Problem
Research questions and friction points this paper is trying to address.
Controlled Post-Alert Incident Orchestration
Response Subsystem
Educational Information Systems
Rule Engine
Large Language Model
Design and Evaluation of a Controlled Post-Alert Incident Orchestration and Response Subsystem Using a Rule Engine and a Local Large Language Model
🤖 AI Summary
本文设计了一个基于规则引擎和本地大型语言模型的教育信息系统警报后事件协调与响应子系统，通过实验验证了其功能正确性和可控性。
📝 Abstract
This paper presents a controlled post-alert incident orchestration and response subsystem for educational information systems. The architecture separates deterministic classification, contextual analysis, human approval, and technical execution. A Rule Engine determines severity and selects the playbook, while Static RAG and a local large language model provide advisory content under Validator, Guardrail, Output Sanitizer, and Safe Fallback controls. Experiments begin after simulated alerts are stored in Elasticsearch. The Rule Engine matched the predefined routing matrix in all 30 boundary cases. The Durable Queue completed 100 events without duplicate tasks, new failed tasks, or unintended firewall rules. An eight-alert contention experiment preserved the configured limit of one active model request, and 30 sequential measurements showed an overall mean post-alert processing time of approximately 33 seconds. The results demonstrate functional correctness, traceability, controlled recovery, and bounded model integration within the evaluated laboratory scope.
Innovation
Methods, ideas, or system contributions that make the work stand out.
Rule Engine
Local Large Language Model
Controlled Recovery
Post-Alert Processing
Static RAG
🔎 Similar Papers
No similar papers found.
