ORACLE-REMEDIATE: Context-Aware, Safety-Verified LLM Remediation for CIS Benchmark Compliance on Oracle Multitenant Databases

Abstract

The Center for Internet Security (CIS) Benchmark for Oracle Database 19c defines 92 security controls whose remediation currently requires extensive manual effort from database administrators. Existing vendor tools—Oracle DBSAT, Data Safe, Enterprise Manager—identify deviations but produce only natural-language recommendations excerpted from the benchmark document. Recent work on large-language-model (LLM)-based security remediation for Kubernetes and embedded firmware has demonstrated that generative models can autoproduce configuration fixes, but no published framework addresses the specific challenges of relational database remediation: per-PDB state semantics, multi-instance Real Application Clusters topology, application dependency awareness, and the operational requirement of a provably invertible rollback. We present ORACLE-REMEDIATE, a context-aware, safety-verified LLM remediation framework for CIS compliance on Oracle Multitenant (CDB/PDB) deployments including RAC and Exadata. The framework grounds LLM generation in live database topology and dependency graphs obtained via retrieval-augmented generation, verifies each candidate remediation through a threelayer pipeline comprising static analysis, semantic invariant checking, and constrained behavioral equivalence, and automatically generates a matched rollback proven invertible through round-trip testing. We propose a comprehensive evaluation of the full CIS Oracle 19c v2.0.0 control set (92 controls) across three deployment topologies—single-instance, two-node RAC, and simulated Exadata—and three LLM backends. The study evaluates Pass@k correctness, safety-violation rates, rollback fidelity, and per-context-class ablation effects. This paper presents the motivation, system design, implementation approach, and evaluation methodology, and releases the benchmark and artifacts as open source.