隨著企業數位轉型加速，網路攻擊的頻率與複雜度驟增。傳統安全資訊與事件管理（SIEM）系統面臨告警疲勞、回應延遲與未知攻擊盲區等嚴峻挑戰。儘管近年資安領域嘗試導入大語言模型（LLM），但現有架構多受限於系統靜態耦合、依賴輕量模型導致分析效能不佳，且流程往往止步於報告生成，缺乏與底層設備連動的主動防禦能力。為解決上述缺點，本研究提出一套基於模型上下文協議（MCP）之生成式AI（Generative artificial intelligence， GenAI）自動化防禦架構。本架構以Wazuh平台匯集日誌，導入n8n作為MCP伺服器與編排引擎，解決傳統AI代理需靜態嵌入程式碼的限制，實現標準化與靈活配置。在防禦機制上，系統以GenAI（Claude、GPT、Gemini）透過多數決機制為核心決策中樞。接收日誌並正規化後，GenAI調用威脅情資（MISP、AlienVault、OTX）驗證來源IP；若判定該IP為非已知威脅，則進一步對日誌所提供的有效載荷(Payload)進行深層邏輯解碼與語意推理，以識別攻擊行為。一旦Payload判定高風險，系統即觸發n8n編排引擎連動OPNsense防火牆進行即時IP封鎖，形成分鐘級響應的主動防禦閉環。實驗結果顯示，本架構成功透過高階語義推理，識破結合混淆手法的Log4Shell及雙重URL編碼的目錄遍歷等惡意攻擊。相較傳統依賴人工介入與工單等待的流程，本系統將平均修復時間（MTTR）從數小時大幅縮短至數分鐘。本研究不僅實證了MCP協議在標準化AI代理與打破系統靜態耦合上的優勢，更為具備高擴展性與主動阻斷能力的新一代AI防禦，提供了一套具體的實踐準則。;Rapid digital transformation has escalated cyberattack complexity， exposing traditional SIEM systems to alert fatigue and blind spots. Current LLM-driven defenses are often limited by static system coupling， lightweight models， and a lack of active firewall intervention. To address this， we propose an automated Generative AI (GenAI) defense architecture based on the Model Context Protocol (MCP). Using Wazuh for log aggregation， the framework innovatively deploys n8n as an MCP server and orchestrator， breaking the limitations of statically embedded AI agents to enable flexible configuration. GenAI (Claude， GPT， Gemini) serves as the core decision hub. It first queries threat intelligence (MISP， AlienVault， OTX) to verify source IPs; if the IP is benign or unknown， it conducts deep semantic reasoning on packet payloads to identify hidden malicious behaviors. Upon detecting high risks， n8n instantly triggers OPNsense firewalls for real-time IP blocking， forming a minute-level active defense loop. Experiments confirm the successful detection of complex threats， including obfuscated Log4Shell and double URL-encoded directory traversals. By bypassing manual intervention， Mean Time to Repair (MTTR) is significantly reduced from hours to minutes. This study validates MCP′s critical advantage in standardizing AI agents and decoupling systems， providing a highly scalable， proactive framework for next-generation automated AI defense.
