Intelligent Automation of Network Security Operations via Intention-Driven Agents and Large Language Models

As modern networks grow in scale and complexity, traditional manual security operations struggle to maintain efficiency, consistency, and adaptability. This paper proposes a novel framework that leverages large language models (LLMs), intention understanding, and autonomous agents to achieve end-to-end automation of network-security operations. By combining the Model-Context Protocol (MCP) with retrieval-augmented generation (RAG), the system interprets human intents expressed in natural language and dynamically maps them to executable security workflows. Key operational functions including configuration inspection, vulnerability hardening, topology mapping, fault diagnosis, and compliance patrol are abstracted into intention-driven tasks executed by agents. A prototype deployed in an enterprise-scale environment shows mean task-completion-time reductions of 82.37% and audit-accuracy gains of 6–15% over expert baselines. These results mark a step toward fully autonomous, intention-aware network-security management.