SERA-IDS: Structured Experience Retrieval-Augmented Intrusion Detection with Small Language Models

Large language models (LLMs) offer a flexible approach to network intrusion detection, but direct classification of numerical flow records can be unreliable without traffic- specific decision boundaries. Retrieval-augmented generation (RAG) enables LLMs to leverage external experience; however, free