arXiv CSopen access

From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation

arXiv:2605.17960v1 [cs.CR] 18 May 2026

From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation Md Navid Bin Islam

Sajal Saha, Senior Member (IEEE)

University of Northern British Columbia Prince George, Canada [email protected]

University of Northern British Columbia Prince George, Canada [email protected]

Abstract—Machine-learning-based Intrusion Detection Systems (IDS) have achieved impressive accuracy in classifying network attacks, yet they consistently fall short on the question that matters most to a security analyst: what should I do next? This paper presents a unified, end-to-end framework that closes the gap between threat detection and actionable response. The system operates in two tightly coupled stages. First, an ensemble of three independently trained binary Deep Neural Networks (DNNs) [1] classifies network traffic flows as Benign, Denial of Service (DoS) [2], or Distributed Denial of Service (DDoS) [3], achieving 99.84% accuracy on the CICIDS2018 [4] dataset and 95.30% on the UNSW-NB15 [5] dataset. Second, a Retrieval-Augmented Generation (RAG) [6] pipeline constructs explanation-aware prompts from the top-5 anomalous features, retrieves the most semantically and lexically relevant guidance from a knowledge base derived from authorized sources and directs a locally deployed language model to synthesise structured, citation-grounded mitigation reports. The RAG-enhanced reports outperform vanilla LLM outputs across all automated evaluation metrics. Index Terms—Intrusion Detection Systems, Deep Learning, Retrieval-Augmented Generation (RAG), Cybersecurity, Large Language Models (LLMs), Denial of Service, Explainable AI (XAI), NIST, MITRE ATT&CK.

I. I NTRODUCTION Modern computer networks are experiencing a rapid increase in cyber threats, especially Denial of Service (DOS) [2] and Distributed Denial of Service (DDoS) [3] attacks. Recent industry reports show that more than 7.9 million DDoS incidents were recorded globally during the first half of 2024 alone [7]. As cyber-attacks continue to grow in scale and complexity, machine learning-based Intrusion Detection Systems (IDS) have become widely used because of their ability to detect attacks with very high accuracy. However, high detection accuracy alone is not sufficient in real-world cybersecurity operations. In practice, detecting an attack is only the first step. Security analysts in a Security Operations Center (SOC) also need to understand the nature of the attack, identify the affected systems, and decide which mitigation actions should be taken immediately. A prediction label such as “DDoS” does not provide enough information to support rapid decision-making

during a live incident. The delay between attack detection and effective response can itself become a security risk, giving attackers additional time to disrupt systems and services. Several important challenges still remain in current IDS research. First, many deep learning-based IDS models operate as black-box systems that provide only prediction labels and confidence scores without explaining how the decision was made [8]. This makes it difficult for security analysts to fully trust or interpret the model outputs. Second, Explainable Artificial Intelligence (XAI) [9] techniques such as SHAP [10] and LIME [11] can identify which features influenced a prediction, but they still do not provide practical mitigation guidance for responding to the attack. Third, valuable cybersecurity knowledge sources such as NIST [12] guidelines, MITRE ATT&CK [13], and ENISA [14] recommendations contain detailed mitigation strategies, but these documents are extensive and difficult to consult during real-time incident response. To address these limitations, this paper proposes a modular end-to-end framework that combines deep learning-based intrusion detection, and RAG for both attack detection and mitigation generation. The framework not only identifies cyberattacks with high accuracy, but also generates structured and evidence-based mitigation reports using authoritative cybersecurity knowledge sources. The main contributions of this work are summarized as follows: 1) We design a structured prompting strategy that combines the predicted attack class, important network features, flow metadata, and security interpretations to provide context-aware inputs for the language model. This helps the model generate mitigation guidance based on the actual attack evidence detected by the IDS. 2) We develop a hybrid retrieval pipeline that combines BM25 [15] keyword search, FAISS-based [16] dense vector retrieval, and cross-encoder reranking to retrieve relevant information from a cybersecurity knowledge base built from authoritative sources including NIST [12] and MITRE [13] documents. 3) Using the retrieved cybersecurity knowledge, the framework generates structured mitigation reports with sup-

porting citations from trusted sources. The generated reports provide actionable recommendations for security analysts during incident response. 4) We evaluate the quality of the generated mitigation reports against expert-written ground truth explanations using BERTScore, ROUGE, and BLEU metrics. Experimental results show that the RAG-enhanced framework produces more accurate and reliable outputs compared to standalone LLM-based generation. The remainder of this paper is organized as follows. Section II surveys related work and identifies the specific gaps this paper addresses. Section III presents the full methodology, including datasets, DNN architectures, prompt construction, knowledge base design, retrieval architecture, and LLM configuration. Section IV reports and discusses experimental results. Section V concludes and outlines future work. II. R ELATED W ORK Recent advancements in cybersecurity have significantly improved the performance of IDS through the use of machine learning and deep learning models. Traditional IDS approaches mostly depended on signature-based or rule-based techniques, which often struggle to detect previously unseen attacks and complex traffic patterns [17]. To overcome these limitations, researchers introduced deep learning architectures capable of learning hidden representations directly from network traffic data. A. Deep Learning-Based Intrusion Detection Systems Deep learning models such as Convolutional Neural Networks (CNNs) [32], Recurrent Neural Networks (RNNs) [33], Long Short-Term Memory (LSTM) networks [34], and Autoencoders [33] have shown strong performance in intrusion detection tasks [22]. These models can automatically learn complex spatial and temporal relationships from highdimensional network traffic data, making them more effective than traditional machine learning approaches. Kim et al. [18] introduced an LSTM-based IDS framework capable of learning sequential traffic behavior for anomaly detection. Their work demonstrated that recurrent architectures can effectively capture dependencies in network flows. Similarly, Yin et al. [19] evaluated RNN-based IDS models and showed significant improvements over traditional classifiers such as Support Vector Machines (SVMs) [35] and Random Forests [36]. Their study highlighted the importance of feature learning in network intrusion detection. Shone et al. [20] proposed a non-symmetric deep autoencoder architecture combined with Random Forest [36] classification for feature extraction and intrusion detection. Their work demonstrated that unsupervised feature learning can improve detection performance while reducing feature engineering complexity. Vinayakumar et al. [21] later presented a comprehensive deep learning framework for cyber threat detection using datasets such as UNSW-NB15 [5] and CICIDS2017 [4]. Their results showed that deep neural networks

can achieve high classification accuracy under complex attack scenarios. Although these approaches achieved impressive detection performance, most of them focused mainly on attack classification accuracy. They generally lacked explainability, contextual reasoning, and actionable mitigation support for security analysts. B. Explainable Artificial Intelligence in IDS As deep learning models became more complex, researchers started investigating XAI techniques to improve trust and interpretability in IDS. Security analysts often require explanations regarding why a network flow was classified as malicious before taking operational decisions. Lundberg and Lee [10] introduced SHAP (SHapley Additive exPlanations), which provides feature-level importance scores for machine learning predictions. Ribeiro et al. [11] proposed LIME (Local Interpretable Model-Agnostic Explanations), a model-agnostic explanation framework capable of interpreting local predictions. Both SHAP and LIME have been widely applied in cybersecurity research to improve IDS interpretability. Several recent IDS studies integrated explainability mechanisms into deep learning pipelines. For example, Tjhai et al. [31] used SHAP explanations to identify influential network traffic features contributing to attack detection decisions. Similarly, Loi et al. [30] demonstrated that explainable IDS frameworks can significantly improve analyst understanding and trust during threat investigation. Despite these improvements, most explainable IDS systems still focus only on feature attribution and attack interpretation. They generally do not provide contextual mitigation recommendations or operational guidance after detection. C. Transformer and LLM-Based Cybersecurity Systems The success of transformer architectures and LLMs has influenced cybersecurity research. Transformer-based models can capture contextual relationships better in sequential data compared to traditional CNN and RNN architectures [21]. Ferrag et al. [23] introduced SecurityBERT, a lightweight transformer-based intrusion detection model designed for IoT and IIoT environments. Their framework used PrivacyPreserving Fixed Length Encoding (PPFLE) to convert network traffic into a textual representation suitable for transformer processing while preserving sensitive information. Other cybersecurity-focused language models such as SecBERT [24] and CyBERT [25] further demonstrated the effectiveness of transformer architectures for threat analysis, malware detection, and vulnerability understanding. However, many transformer-based IDS systems still operate mainly as classification frameworks. While they improve contextual understanding, they often lack reliable retrieval mechanisms and grounded mitigation generation pipelines [37]. D. RAG in Cybersecurity RAG has emerged as a promising approach for improving the reliability and factual grounding of LLMs [6]. Instead

TABLE I C OMPARISON OF E XISTING IDS, XAI, AND RAG-BASED C YBERSECURITY S YSTEMS

Work Lippmann et al. [17] Kim et al. [18] Yin et al. [19] Shone et al. [20] Vinayakumar et al. [21] Lansky et al. [22] Lundberg and Lee [10] Ribeiro et al. [11] Ferrag et al. [23] SecBERT [24] CyBERT [25] MoRSE [26] CyberRAG [27] Setiawan & Soewito [28] Pinto et al. [29] Loi et al. [30] Tjhai et al. [31] Proposed Framework

DL-Based IDS ✗ ✓ ✓ ✓ ✓ ✓ ✗ ✗ ✓ Partial Partial ✗ Partial ✗ Partial ✓ ✓ ✓

XAI ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓ Partial ✗ ✗ ✗ ✓ ✗ ✗ ✓ ✓ ✓

LLM/RAG ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓ ✓ ✓ ✓ ✓ ✓ ✗ ✗ ✗ ✓

of relying only on the model’s pre-trained knowledge, RAG systems retrieve relevant external documents during response generation. In cybersecurity, RAG has been utilized to reduce hallucinations and improve the accuracy of generated security recommendations. Simoni et al. [26] introduced MoRSE, a chatbot that combines structured and unstructured retrieval pipelines to answer cybersecurity-related questions. Their results showed that retrieval-enhanced responses were significantly more accurate and context-aware than standard LLM outputs. Blefari et al. [27] proposed CyberRAG, an agent-based RAG framework that combines multiple attack-specific classifiers with retrieval-enhanced explanation generation. Their system achieved strong attack reporting performance while improving interpretability and operational usability. Setiawan and Soewito [28] explored a multi-agent RAG framework for automatic Snort rule generation using cybersecurity knowledge sources such as Common Weakness Enumeration (CWE). Their system demonstrated that instructionbased prompting combined with retrieval mechanisms can improve threat response automation. E. Automated Threat Mitigation and Incident Response Automated mitigation and incident response systems have also got the attention in recent years due to the increasing volume of security alerts generated by modern networks. Traditional Security Orchestration, Automation, and Response (SOAR) platforms help automate incident handling workflows but often depend heavily on manually crafted rules and predefined rule-books. Pinto et al. [29] discussed the growing cybersecurity risks in smart grid infrastructures and highlighted the limitations of current detection and mitigation frameworks under real-world attack scenarios. Their work emphasized the importance of in-

Trusted KB ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✓ Partial ✓ ✗ ✗ ✗ ✓

Mitigation ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ Advisory ✓ Partial Limited ✗ ✗ ✓

Hybrid Retrieval ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ Partial Partial ✗ ✗ ✗ ✗ ✓

Detection-to-Mitigation ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ ✗ Partial ✗ ✗ ✗ ✗ ✓

tegrating intelligent detection systems with adaptive response mechanisms. Recent studies also explored the integration of cybersecurity knowledge bases such as NIST [12], MITRE ATT&CK [13], ENISA [38] into automated incident response systems. However, most existing automated mitigation frameworks either operate independently from IDS systems or rely heavily on generic responses without incorporating contextual attack evidence derived from network traffic analysis. F. Research Gap and Motivation When analyzing existing literature, several important limitations become clear. Deep learning-based IDS frameworks achieve strong attack detection performance but usually lack explainability and mitigation support. Explainable IDS systems improve interpretability but generally stop at feature attribution without generating actionable responses. Transformer and LLM-based cybersecurity systems improve contextual reasoning but often lack authoritative grounding and retrieval validation. Similarly, many RAG-based cybersecurity frameworks focus on threat retrieval rather than tightly integrating intrusion detection with mitigation generation. Another important limitation is that most existing works do not address real-world operational challenges such as confidence-aware analysis, hybrid retrieval architectures, reranking mechanisms, and grounded mitigation reporting. Very few studies provide an end-to-end framework that combines intrusion detection, explainability, authoritative retrieval, and context-aware mitigation generation in a unified pipeline. Motivated by these limitations, this paper proposes a complete IDS framework that combines deep learning-based intrusion detection with a RAG pipeline for mitigation report generation. Unlike existing approaches, the proposed framework integrates explanation-aware prompt construction,

hybrid lexical-semantic retrieval, cross-encoder reranking, confidence-aware classification, and grounded mitigation generation using trusted cybersecurity sources. The system not only detects attacks but also generates structured, actionable, and citation-grounded mitigation reports suitable for realworld cybersecurity operations. III. P ROPOSED M ETHODOLOGY This section presents the complete technical design of the proposed IDS–RAG framework. The system follows a fivestage modular pipeline: (1) data acquisition and preprocessing, (2) confidence-calibrated DNN classification, (3) explanationaware prompt construction, (4) hybrid RAG retrieval and reranking, and (5) structured LLM report generation. The overall architecture is illustrated in Fig. 1. A. System Architecture Overview The proposed pipeline ingests raw network flow records, preprocesses them into a unified 66-dimensional feature space, classifies each flow using an ensemble of three binary DNNs, extracts the most anomalous features for prompt construction, retrieves relevant cybersecurity guidance through a hybrid retrieval system, and generates a structured mitigation report using a locally deployed LLM. Each stage is independently modular: the classifier can be retrained on new traffic data without modifying the RAG system, and the knowledge base can be extended with new authorative sources without retraining the classifier. B. Stage 1: Data Acquisition and Preprocessing We have used two publicly available benchmark datasets. The CICIDS2018 dataset [4] provides 1.15 million flow records spanning three classes (Benign, DoS, DDoS) across 66 flow-level features. The UNSW-NB15 dataset [39] provides a complementary evaluation environment with 49 original features across ten classes. To enable cross-dataset evaluation, all nine attack classes in UNSW-NB15 are remapped to a three-class scheme: complex multi-stage attacks (Fuzzers, Exploits, Generic, Reconnaissance) are combined under DDoS due to their distributed, high-impact characteristics, while direct volumetric attacks are assigned to DoS. Numeric features such as packet counts, byte counts, TTL values etc. are retained as-is. Categorical features like protocol, service, connection state etc. are one-hot encoded. Zeropadding features are constructed to bridge the 49-to-66 dimensional gap, ensuring that both datasets share an identical 66dimensional feature space. A feature interpretation dictionary is maintained that maps each technical feature name to a human-readable description and a security implication string. Table II shows ten representative entries from this dictionary. A scikit-learn [40] pipeline applies z-score normalization to all numeric features: xj − µ j (1) x̂j = σj where µj and σj are the mean and standard deviation of feature j computed over the training split. Stratified 70/15/15

TABLE II R EPRESENTATIVE F EATURE I NTERPRETATION D ICTIONARY E NTRIES

Feature

Description

Security Implication

sttl

Source Live

ct stat ttl

Conn. state transitions Conn. to same service Source byte throughput Destination byte load Bytes per second

Irregular values may indicate spoofed packets Abnormal state cycles signal protocol abuse Repeated targeting of one endpoint High values consistent with flooding Asymmetric loads suggest amplification High rate indicates volumetric activity Scan DoS behaviour at high values Anomalous values flag scan tools Small uniform sizes indicate flood UDP/ICMP often used in amplification

ct srv dst sload dload Flow Bytes/s Flow Packets/s Init Win Bytes Avg Packet Size Protocol

Time-to-

Packets per second Initial TCP window Mean payload bytes L4 protocol number

train/validation/test splits are used across both datasets to preserve class proportions and ensure unbiased evaluation under severe class imbalance. C. Stage 2: DNN Classification Rather than training a single three-way classifier, we deploy an ensemble of three independently trained binary DNNs [41], one per class Benign-vs-Rest, DoS-vs-Rest, DDoS-vs-Rest. This one-vs-rest strategy facilitates the learning objective of each model by allowing it to focus on a single decision boundary rather than simultaneously separating multiple attack categories. 1) Network Architectures: Two different DNN architectures are employed depending on the distribution of the dataset. For the CICIDS2018 [4] dataset, the model consists of three fully connected hidden layers with dimensions [128, 64, 32]. Each hidden layer uses the ReLU activation function followed by dropout regularization [42] with a dropout probability of p = 0.3 to reduce overfitting and improve generalization. For the UNSW-NB15 [39] dataset, the model contains four fully connected hidden layers with dimensions [256, 128, 64, 32]. ReLU activation is applied after each layer, while batch normalization [43] is incorporated to stabilize training and reduce internal covariate shift. In addition, graduated dropout regularization is used with probabilities decreasing from 0.4 to 0.2 across the deeper layers. Both architectures terminate with a softmax output layer [44]. The full forward pass for an input flow x ∈ R66 through the k-layer network is: h(0) = x

(2)

Fig. 1. Proposed end-to-end framework for intrusion detection and RAG-enhanced mitigation generation. The architecture integrates DNN-based attack classification, explanation-aware prompt construction, hybrid retrieval using BM25 and FAISS with cross-encoder reranking, and LLM-based mitigation report generation using authoritative cybersecurity knowledge sources.

   h(l) = ReLU BN W(l) h(l−1) + b(l) , l = 1, . . . , k − 1 (3)   ŷ = Softmax W(k) h(k−1) + b(k)

(4)

where W(l) and b(l) represent the learnable weights and bias parameters of layer l, and BN denotes the batch normalization operation, which is applied only in the UNSW-NB15 architecture. 2) Class Imbalance Problem: In the UNSW-NB15 [39] dataset, DoS traffic constitutes only 0.64% of total samples. Under standard cross-entropy training, this causes the opti-

mizer to achieve a slightly low loss by predicting the majority class for nearly all inputs, yielding DoS recall close to 0. 3) Class-Weighted Binary Cross-Entropy: To address this, the binary cross-entropy loss is modified with inversefrequency class weights. For a single sample with true label y ∈ {0, 1} and predicted probability ŷ, the weighted loss is:   LWBCE (y, ŷ) = − w1 y log(ŷ) + w0 (1 − y) log(1 − ŷ) (5) where the class weights wc are computed as: wc =

N 2 Nc

(6)

TABLE III A BLATION S TUDY: E FFECT OF E ACH BALANCING I NTERVENTION ON UNSW-NB15 D O S R ECALL

Configuration

DoS Recall (%)

Baseline (no balancing) + Class-weighted BCE + Random oversampling (1:5) + Controlled undersampling + F1-based model selection (Full System)

0.30 28.4 71.2 84.9 97.6

TABLE IV C ONFIDENCE T IER M APPING FOR SOC T RIAGE

Confidence

Tier

SOC Action

≥ 0.95 [0.70, 0.95) [0.50, 0.70) < 0.50

Very High High Medium Low

Fully automated response Analyst review within 15 min Analyst review within 1 hr Manual deep inspection

N is the total number of training samples and Nc is the number of samples in class c. The total training objective over a minibatch of N samples is: N

Ltotal =

1 X LWBCE (yi , ŷi ) N i=1

(7)

This formulation implements empirical risk minimization under class-balanced constraints, ensuring that minority-class errors receive proportionally larger gradient contributions [45]. 4) Additional Balancing Interventions: Beyond loss weighting, three further strategies are applied specifically for the UNSW-NB15 DoS classifier: (i) random oversampling of the minority DoS class to a 1:5 ratio relative to the Benign class [46], (ii) controlled undersampling of the Benign majority, and (iii) model selection based on macroaveraged F1-score rather than accuracy. The combined interventions raise DoS recall from 0.30% to 97.6%—a 325-fold improvement (Table III). 5) Ensemble Prediction and Confidence Calibration: All three classifiers receive the same input flow simultaneously. Let pc denote the softmax probability assigned by classifier c ∈ {Benign, DoS, DDoS}. The final prediction and confidence are given by: ĉ = arg max pc , c

Confidence = max pc c

(8)

The scalar confidence score is mapped to a discrete tier for SOC prioritization, as shown in Table IV. The full procedure is presented as Algorithm 1. All models are trained with the Adam [47] optimizer, an initial learning rate of 1 × 10−3 , batch size 512, and early stopping with patience of 5 epochs monitored on validation F1-score. Training converges within 14–19 epochs across all classifiers on both datasets.

Algorithm 1 Ensemble Confidence-Calibrated Classification Require: Feature vector x ∈ R66 ; trained classifiers fB , fD , fDD Ensure: Predicted class ĉ, confidence conf, tier label t 1: pB ← fB (x)[1] {Benign probability} 2: pD ← fD (x)[1] {DoS probability} 3: pDD ← fDD (x)[1] {DDoS probability} 4: ĉ ← arg max{pB , pD , pDD } 5: conf ← max{pB , pD , pDD } 6: if conf ≥ 0.95 then 7: t ← V ERY H IGH 8: else if conf ≥ 0.70 then 9: t ← H IGH 10: else if conf ≥ 0.50 then 11: t ← M EDIUM 12: else 13: t ← L OW 14: end if 15: return ĉ, conf, t

D. Stage 3: Explanation-Aware Prompt Construction Conventional approaches query an LLM with a generic question such as “Describe mitigation strategies for a DDoS attack” which produces textbook-level advice contextually detached from the specific event. Our approach constructs a structured, evidence-rich prompt that binds the LLM’s reasoning to the concrete evidence produced by the classifier. 1) Top-K Feature Selection: Following classification, the K = 5 features most influential to the model’s prediction are extracted. Feature importance scores are computed using gradient-based attribution [48]. The gradient of the predicted class score with respect to each input dimension is computed and its absolute value taken as a proxy for feature influence: Importance(j) =

∂ ŷĉ ∂xj

(9)

Features are sorted in descending order of importance and the top-5 selected. For the experiments in this paper, five security-relevant features per dataset were additionally identified through domain knowledge: CICIDS2018: Flow Bytes/s, Flow Packets/s, Init Win Bytes Forward, Protocol, Average Packet Size. • UNSW-NB15: sttl (source TTL), ct_state_ttl (connection state transitions), dload (destination byte load), sload (source throughput), ct_srv_dst (repeated service connections). •

2) Feature Description Mapping: Each selected feature is mapped through the interpretation dictionary (Table II) to produce a natural-language evidence string. For example, a flow with sttl = 245 becomes “Source TTL of 245 is elevated and irregular; may indicate packet spoofing or TTL manipulation consistent with DoS traffic engineering,” and Flow Bytes/s = 4.7 × 106 becomes “Abnormally high byte

TABLE V P ROMPT B LOCK S TRUCTURE AND VARIABLE S OURCES Block

Variables

Source Stage

Detection Context

attack_class, confidence_score, confidence_tier, dataset

Stage 2 (DNN)

Flow Metadata

flow_id, timestamp, src_ip, src_port, dst_ip, dst_port, protocol

Stage 1 (preprocessing)

Explanation-Aware Prompt Template SYSTEM: You are a senior cybersecurity analyst. Generate a structured incident response report based on the evidence provided. Cite NIST Special Publications and MITRE ATT&CK techniques explicitly where applicable. USER:

Anomalous Indicators

feature_{1..K}_name, Stage 3 (XAI) feature_{1..K}_value, feature_{1..K}_interpretation

Retrieved Knowledge

retrieved_chunks

Stage 4 (RAG)

rate suggests sustained bulk data flooding, consistent with volumetric denial-of-service activity.” 3) Prompt Template Construction: The structured prompt is assembled using LangChain’s PromptTemplate framework [49] and comprises four semantically distinct blocks, each contributing different contextual information to guide report generation. Table V summarizes the four blocks, their constituent variables, and the pipeline stage responsible for populating each. The complete template is shown in Box 1. The system role instruction fixes the LLM persona as a senior cybersecurity analyst and imposes an explicit citation requirement for NIST Special Publications and MITRE ATT&CK techniques, ensuring that generated reports remain grounded in authoritative sources rather than relying on the model’s parametric knowledge alone. The detection context block provides the predicted attack class, scalar confidence score, and SOC triage tier from Algorithm 1, binding the model’s reasoning to the specific classification outcome. The flow metadata block supplies network-level identifiers that enable traceability in automated reporting pipelines and allow the LLM to tailor its language to the operational context of the event. The anomalous indicators block injects the topK feature–interpretation pairs produced in Stage 3, providing the concrete evidence from which the model constructs its rationale. The retrieved knowledge block is populated by the RAG pipeline with the top-k = 5 chunks selected by the crossencoder; in the vanilla LLM baseline condition this field is left empty, isolating the contribution of retrieval augmentation. Finally, the report request block specifies the five-section output structure required of the model. 4) Metadata Enrichment: The prompt incorporates flow metadata [50] (IP addresses, ports, protocol, timestamp, dataset provenance, confidence tier) to enable traceability in automated reporting systems and to allow the LLM to tailor its language to the specific operational context. E. Stage 4: RAG Pipeline 1) Comprehensive Knowledge Base Construction: The RAG system’s retrieval quality depends on the quality of the knowledge base it searches. We construct a domain-specific,

[DETECTION CONTEXT] Attack class Confidence ({confidence_tier}) Dataset [NETWORK FLOW METADATA] Flow ID Timestamp Source Destination Protocol

{attack_class} {confidence_score} {dataset} {flow_id} {timestamp} {src_ip}:{src_port} {dst_ip}:{dst_port} {protocol}

[KEY ANOMALOUS INDICATORS] Top-{K} features most influential in this decision: Feature 1 : {feature_1_name} = {feature_1_value} ,→ {feature_1_interpretation} . . . Feature K : {feature_K_name} = {feature_K_value} ,→ {feature_K_interpretation} [RETRIEVED KNOWLEDGE CONTEXT] {retrieved_chunks} ▷ injected by RAG pipeline [REPORT REQUEST] Generate a structured report with sections: 1. Rationale 4. Threat Assessment 2. Key Indicators 5. Recommendations 3. Confidence Assessment

authoritative knowledge base from fourteen carefully selected cybersecurity documents. Nine NIST Special Publications [12] were included: SP 800-61 Rev. 2 (incident handling), SP 80094 (IDS guidelines), SP 800-83 Rev. 1 (malware incident response), SP 800-115 (security testing), SP 800-137 (continuous monitoring), SP 800-92 (log management), SP 800123, SP 800-125, and SP 800-144. The MITRE ATT&CK Enterprise Framework [13] was included with particular emphasis on T1498 (Network Denial of Service) and T1498.001 (Direct Network Flood). Additional sources include the CIS Critical Security Controls, SOC incident response playbooks, and curated attack signature databases [51]. 2) Semantic Chunking: Documents are segmented using a semantic chunking strategy [52] rather than naive fixed-size splitting. Chunk boundaries are placed at semantic units with a 200-token overlap between adjacent chunks, preserving conceptual continuity across boundaries. Each chunk is annotated with: (i) traffic relevance label (Benign / DoS / DDoS), (ii)

source document identifier, (iii) NIST/MITRE reference, and (iv) section identifier. The final knowledge base contains 5,234 semantically coherent, metadata-tagged chunks. 3) Hybrid Retrieval Architecture: The retrieval system combines two complementary paradigms lexical and semantic search followed by a reranking stage. a) Lexical Retrieval: The lexical retrieval stage uses the BM25 ranking function [15] to measure the relevance between the user query Q and each knowledge document D. The BM25 relevance score is computed as: ScoreBM25 (D, Q) =

X

IDF(qi )

i

×

f (qi , D)(k1 + 1)   |D| f (qi , D) + k1 1 − b + b avgdl

(10)

where f (qi , D) denotes the frequency of query term qi in document D, |D| represents the document length, and avgdl is the average document length across the corpus. The parameter k1 controls term frequency saturation, while b determines the degree of document length normalization. In this paper, standard BM25 hyper-parameters k1 = 1.5 and b = 0.75 are used. b) Semantic Retrieval: All knowledge chunks are encoded into 768-dimensional dense vectors using the all-mpnetbase-v2 sentence transformer [53] and indexed in a FAISS [54] approximate nearest-neighbor index. Cosine similarity [55] between query embedding q and chunk embedding d is:

Algorithm 2 Hybrid RAG Retrieval Pipeline Require: Query q (attack class + features + metadata); knowledge base KB; k = 5 Ensure: Top-k ranked chunks C ∗ 1: qexp ← QueryExpand(q, thesaurus) 2: Cbm25 ← BM25(qexp , KB, n=30) 3: qemb ← Encode(qexp ) 4: Csem ← FAISS(qemb , KB, n=30) 5: Ccand ← Dedup(Cbm25 ∪ Csem ) 6: for all d ∈ Ccand do 7: sbm25 ← NormBM25(d, qexp ) 8: ssem ← Cos(qemb , Encode(d)) 9: sfuse ← 0.60 · ssem + 0.40 · sbm25 10: end for 11: C30 ← Top-30{sfuse } 12: for all d ∈ C30 do 13: srr ← CrossEnc(q, d) 14: end for 15: C ∗ ← Top-k{srr } 16: return C ∗

relevance score in [0, 1], and the top-k = 5 chunks are selected as final retrieval results. The complete pipeline is presented in Algorithm 2. F. Stage 5: LLM-Based Report Generation

LLaMA 3:8B [57], accessed through the Ollama [58] framework for fully local inference, serves as the generation backq·d bone. Network traffic data processed by an IDS is typically Sim(q, d) = (11) ∥q∥2 ∥d∥2 sensitive, and routing it to external API services creates both c) Query Expansion: To improve retrieval coverage, the privacy and regulatory risks. 1) Structured Report Format: The LLM is instructed via query is expanded using a cybersecurity-specific synonym the prompt template (Listing 1) to produce a five-section dictionary that incorporates semantically related attack terincident response report, each section serving a distinct opminology. For example, the term “DoS” is expanded with erational function for SOC analysts. The Rationale section related expressions such as “denial of service,” “resource links the observed anomalous network features to the classified exhaustion,” and “flooding,” while “DDoS” is associated with attack type, with explicit citations to the applicable NIST terms including “distributed denial of service,” “botnet flood,” Special Publication and MITRE ATT&CK technique. The Key and “amplification attack.” The expanded query representation Indicators section enumerates the top-K features selected is applied to both the lexical BM25 retrieval stage and the in Stage 3 alongside their security interpretations, providing semantic embedding-based retrieval stage in order to improve the evidentiary basis for the classification. The Confidence recall and increase the possibility of retrieving contextually Assessment section evaluates detection reliability by contexrelevant cybersecurity knowledge. tualizing the scalar confidence score within the SOC triage d) Score Fusion: Normalised BM25 and cosine similartier produced by Algorithm 1, allowing analysts to calibrate ity scores are combined as a weighted fusion: their response urgency accordingly. The Threat Assessment Scorefusion (D, Q) = 0.60·Simsem (D, Q)+0.40·ScoreBM25 (D, Q) section characterizes the operational impact of the detected (12) attack using the risk assessment principles of NIST SP 800-30, The 60/40 weighting was determined empirically and including affected assets and potential consequences. Finally, favours semantic relevance while preserving sensitivity to ex- the Recommendations section presents specific, prioritized act technical terminology. The top 20–30 chunks are forwarded mitigation actions drawn directly from the top-k retrieved to reranking. knowledge chunks, each accompanied by its source citation. e) Cross-Encoder Reranking: The ms-marco-MiniLM- The five-section structure is deliberately aligned with standard L-6-v2 cross-encoder [56] encodes each query–chunk pair, SOC incident response workflows, ensuring that generated enabling fine-grained relevance interactions that bi-encoders reports are immediately actionable without requiring analyst cannot capture. Each of the 20–30 candidates receives a reformatting or supplementary research.

2) Fallback Mechanism: If retrieval returns fewer than three chunks with cross-encoder score above 0.5, a fallback knowledge context containing general NIST SP 800-61 incident response principles [59] is injected to guarantee consistent output quality. 3) Vanilla LLM Baseline: To isolate the contribution of RAG, a vanilla LLM baseline receives the identical explanation-aware prompt but with the {retrieved_chunks} field replaced by an empty string. This controls for prompt design effects and isolates the value of retrieval augmentation. 4) Expert Ground Truth Development: To enable rigorous evaluation, expert-aligned ground truth explanations were constructed from primary sources rather than researcherauthored text. Ground truth texts were merged from NIST SP 800-61, NIST SP 800-94 [60], MITRE ATT&CK T1498/T1498.001 [13], and RFC 4732 [61]. Three ground truth documents were produced, one per class: Benign: RFC-compliant protocol interactions, balanced bidirectional traffic, human-paced timing, correct TCP handshake sequences. • DoS: single-source high-volume traffic, abnormal packet rates, resource exhaustion patterns, NIST SP 800-61 [12] incident handling procedures, MITRE T1498 [13] indicators, rate limiting and SYN cookie recommendations. • DDoS: distributed traffic sources, synchronized attack timing, botnet coordination, large-scale bandwidth consumption, DNS/NTP amplification, RFC 4732 [61] mitigation guidance, MITRE T1498.001 [62] countermeasures.

•

Each ground truth document is 300–600 words, matching the target length of generated explanations to avoid artificial length-mismatch penalties. G. Implementation Details The model has been developed using Python 3.11 with PyTorch 2.1.0 for neural network training. Neural network training has been done on an amd Ryzen-5 3600X workstation with 32 GB RAM and NVIDIA RTX 2060 GPU running Windows 11. The RAG pipeline integrates FAISS [54] 1.7.4 for vector search, LangChain [63] 0.1.0 for LLM management, and LLaMA 3:8B [57] with 4-bit quantization using Ollama [64]. The model also uses OpenAI’s text-embedding-ada-002 [65] model for all embeddings. IV. R ESULT & D ISCUSSION This section evaluates the proposed IDS–RAG framework across both detection and mitigation tasks. The classification performance of the ensemble DNN is analyzed on the CICIDS2018 [66] and UNSW-NB15 [39] datasets, followed by an evaluation of the hybrid retrieval pipeline and the quality of the generated mitigation reports. Finally, qualitative analysis and operational feasibility are discussed to assess the framework’s practicality in real-world SOC environments.

TABLE VI CICIDS2018 C LASSIFICATION P ERFORMANCE

Class

Precision

Recall

F1

Support

Benign DoS DDoS

1.00 0.99 1.00

1.00 1.00 1.00

1.00 0.99 1.00

116,248 58,342 75,460

Accuracy Macro Avg Weighted Avg

1.00 1.00 1.00

(250,050 samples) 1.00 1.00 — 1.00 1.00 —

TABLE VII UNSW-NB15 C LASSIFICATION P ERFORMANCE (BALANCED T EST S ET )

Class

Precision

Recall

F1

Support

Benign DoS DDoS

1.0000 0.9673 0.8978

0.9940 0.8889 0.9760

0.9970 0.9264 0.9353

38,420 38,115 38,465

Accuracy Macro Avg Weighted Avg

0.9530 (115,000 samples) 0.9550 0.9530 0.9529 — 0.9550 0.9530 0.9529 —

A. Classification Performance on CICIDS2018 Our proposed DNN architecture achieves an overall accuracy of 99.84% on the CICIDS2018 test set (250,050 flows). Table VI reports per-class precision, recall, and F1-score. DDoS detection is near-perfect (F1 = 0.9999), with zero missed DDoS flows. DoS detection achieves F1 = 0.9935. The only meaningful error source is 150 misclassified Benign flows out of 250,050 (0.06% false-positive rate), well below thresholds that would cause alert fatigue in operational systems. ROC-AUC values are ≈ 1.0 for all three classifiers (Fig. 2), and confidence scores cluster tightly in [0.98, 1.00] for correct predictions. Training dynamics confirm robust generalization: all classifiers converge within 14–19 epochs with a train/validation accuracy gap below 0.0002 at convergence, and validation loss plateaus at 0.0008–0.0010, confirming that dropout and batch normalization effectively prevent overfitting (Figs. 4 and 5). B. Classification Performance on UNSW-NB15 The UNSW-NB15 experiment is the more challenging evaluation: DoS traffic constitutes only 0.64% of total samples—a 156:1 class imbalance. Without balancing interventions, DoS recall collapses to 0.30%. With the full four-part balancing strategy, DoS recall rises to 97.6%. Overall accuracy on a balanced test set reaches 95.30% (Table VII). ROC-AUC values are 1.000 for Benign and 0.977 for both attack classes (Fig. 3). C. Cross-Dataset Generalization The 4.54% accuracy difference between CICIDS2018 (99.84%) and UNSW-NB15 (95.30%) is mainly due to dif-

ferences in dataset characteristics, including feature distributions, traffic-generation environments rather than overfitting. Despite these, the proposed system still achieves above 95% accuracy on UNSW-NB15 [39] without requiring any major architectural changes. Only the balancing strategies, such as loss weighting and oversampling, were adjusted for the dataset, demonstrating the strong generalization capability of the ensemble architecture.

TABLE VIII R ETRIEVAL P ERFORMANCE AND K NOWLEDGE G ROUNDING

Metric

Value

Retrieval Performance Precision@5 Recall@5 Mean Reciprocal Rank (MRR) Retrieval Success Rate Average Retrieval Latency

0.91 0.84 0.87 0.97 1.8 s

Knowledge Grounding NIST Citation Rate MITRE Citation Rate Avg. Citations per Explanation

93.3% 86.7% 4.2

dation losses of 0.0008–0.0010 confirm successful regularization through dropout, batch normalization, and early stopping. The operating points achieved (TPR > 95%, FPR < 5%) are critical for preventing alert fatigue in operational SOC deployments [67]. E. Retrieval Performance and Knowledge Grounding

Fig. 2. ROC Curves for CSECICIDS2018 Dataset

Table VIII summarizes the retrieval pipeline’s performance on 33 evaluation queries. Precision@5 of 0.91 indicates that 91% of the five returned chunks are genuinely relevant; Recall@5 of 0.84 indicates that 84% of all relevant chunks appear in the top-5; MRR of 0.87 confirms that the most relevant chunk typically ranks at or near position 1. The 97% retrieval success rate (32/33 queries successfully resolved) at an average latency of 1.8 s demonstrates both effectiveness and practical feasibility. Knowledge grounding metrics show that NIST publications [12] are cited in 93.3% of reports and MITRE ATT&CK [13] techniques in 86.7%, with an average of 4.2 authoritative citations per report. This citation density is a key differentiator from vanilla LLM reports and directly supports compliance with security documentation standards such as ISO 27035 [68] and NIST [60] incident response requirements. F. RAG vs. Vanilla LLM: Quantitative Evaluation

Fig. 3. ROC Curves for UNSW-NB15 Dataset

D. Model Training and Validation Analysis Figs. 4 and 5 show that all three classifiers converge smoothly with minimal train/validation divergence. Final vali-

Table IX presents the NLP evaluation results comparing vanilla and RAG-enhanced reports against expert ground truth, computed using BERTScore [69], ROUGE [70], and BLEU [71]. The RAG pipeline outperforms the vanilla baseline across every metric. BERTScore F1 improves by 4.4%, reflecting better semantic alignment. ROUGE-1 improves by 32.5% and ROUGE-2 by 126.4%, indicating substantially better coverage of critical unigrams and the technical bigram phrases (e.g., “rate limiting”, “SYN cookie”, “upstream filtering”) that characterize authoritative mitigation guidance. BLEU improves by 244.1%, the largest relative gain, reflecting the RAG pipeline’s ability to reproduce specific technical phraseology directly from retrieved NIST [60] / MITRE [13] sources.

Fig. 4. Validation Accuracy Progression for Benign, DoS, and DDoS Classifiers

Fig. 5. Training and Validation Loss for Benign, DoS, and DDoS Classifiers

TABLE IX E XPLANATION Q UALITY: VANILLA LLM VS . RAG-E NHANCED LLM (B OTH VS . E XPERT G ROUND T RUTH )

Metric

Vanilla

RAG-Enhanced

∆

BERTScore F1 BERTScore Precision BERTScore Recall ROUGE-1 ROUGE-2 ROUGE-L BLEU

0.8659 0.8784 0.8558 0.4733 0.1387 0.2219 0.0570

0.9038 0.9080 0.9016 0.6271 0.3141 0.3916 0.1961

+4.4% +3.4% +5.4% +32.5% +126.4% +76.5% +244.1%

All improvements are statistically significant at p < 0.001 under a paired Wilcoxon signed-rank test [72] across 36 generated reports. The magnitude of the ROUGE-2 and BLEU gains both measuring phrase-level precision rather than semantic similarity which is particularly informative. These metrics reward exact n-gram matches with the ground truth, and

the only way to achieve them is to use the same technical terminology as the expert references, which the RAG pipeline does by retrieving and incorporating text directly from those references. Fig. 6 confirms visually that RAGenhanced outputs dominate vanilla outputs on all five quality dimensions: Technical Accuracy, Domain Knowledge, Detail Level, Professional Terminology, and Actionability. G. Qualitative Analysis of Generated Reports Across the 36 mitigation reports reviewed for the CICIDS2018 [66] and UNSW-NB15 [39] datasets, the system consistently produces structured, operationally appropriate output. For DDoS attacks, reports correctly escalate to infrastructure-level responses rather than host-level countermeasures. For DoS attacks, reports focus on rate limiting, SYN cookie activation, and source IP blocking. For Benign traffic, reports recommend continued monitoring and baseline validation, appropriately avoiding false-alarm escalation. The structural layout of a typical generated report is shown in Fig. 7.

DNN provides reliable traffic classification, while the hybrid retrieval pipeline grounds the generated reports in authoritative cybersecurity knowledge. As a result, the system produces mitigation reports that are more accurate, explainable, contextaware, and operationally useful than those generated by vanilla language models. Key Summary The proposed ensemble DNN achieved strong detection performance with 95%—99% accuracy. • The hybrid BM25 + FAISS retrieval pipeline achieved 97% retrieval success while grounding reports in trusted cybersecurity knowledge sources. • RAG-enhanced reports substantially outperformed vanilla LLM outputs across BERTScore, ROUGE, and BLEU metrics. • The framework successfully bridges the gap between intrusion detection and actionable incident response by generating explainable, context-aware, and operationally useful mitigation reports. •

Fig. 6. Performance Quality

Core LLM Reasoning Synthesizes classification output, feature indicators, and retrieved knowledge chunks

Analytical Summary Key indicators, anomaly patterns, and supporting evidence

Feature Vector Summary Feature values and interpretation of security relevance

Conclusion Final determination (Benign / DoS / DDoS) with confidence-aligned assessment

Fig. 7. Structure of the explanation generated by the LLM.

V. C ONCLUSION This paper has presented an end-to-end intrusion detection and mitigation framework that combines a confidencecalibrated ensemble of binary DNNs with a hybrid RetrievalAugmented Generation pipeline grounded in authoritative cybersecurity knowledge. The framework addresses a persistent and important gap in the IDS literature: the absence of actionable, explainable, and source-grounded guidance at the point of detection. The DNN achieves 99.84% accuracy on CICIDS2018 and 95.30% on UNSW-NB15; the RAG pipeline retrieves relevant guidance with 97% success from a 5,234chunk knowledge base, and generates structured 400–500word mitigation reports. RAG-enhanced reports outperform vanilla LLM outputs by 32.5% ROUGE-1, 126.4% ROUGE2, and 244.1% BLEU against expert ground truth, with all differences significant at p < 0.001. In the future, we plan to extend the classifier to a broader attack taxonomy; implementing multi-flow temporal analysis for slow-rate and distributed attacks and continuously updating the knowledge base as new NIST Publications and MITRE ATT&CK entries are released. R EFERENCES

Vanilla LLM reports are not factually incorrect; they identify rate limiting and monitoring as relevant but remain at a generic level that is not suitable for direct SOC use. They contain no specific NIST [8] control references, no MITRE [13] technique identifiers, and no tailored procedures. An analyst receiving a vanilla report would need to independently research applicable frameworks before acting; an analyst receiving a RAGenhanced report can proceed directly to implementation. Overall, the experimental results demonstrate that the proposed IDS–RAG framework effectively bridges the gap between attack detection and actionable response. The ensemble

[1] K. Fukushima, “Neocognitron: A self-organizing neural network model for a mechanism of pattern recognition unaffected by shift in position,” Biological cybernetics, vol. 36, no. 4, pp. 193–202, 1980. [2] A. Hussain, J. Heidemann, and C. Papadopoulos, “A framework for classifying denial of service attacks,” in Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications, 2003, pp. 99–110. [3] J. Mirkovic and P. Reiher, “A taxonomy of ddos attack and ddos defense mechanisms,” ACM SIGCOMM Computer Communication Review, vol. 34, no. 2, pp. 39–53, 2004. [4] I. Sharafaldin, A. Habibi Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018). SCITEPRESS - Science and Technology Publications, 2018, pp. 108–116.

[5] N. Moustafa and J. Slay, “Unsw-nb15: A comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),” in 2015 Military Communications and Information Systems Conference (MilCIS). IEEE, 2015, pp. 1–6. [6] P. Lewis, E. Perez, A. Piktus, F. Petroni, V. Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel et al., “Retrievalaugmented generation for knowledge-intensive nlp tasks,” Advances in neural information processing systems, vol. 33, pp. 9459–9474, 2020. [7] J. John and E. A. Fraser, “Ddos attacks on cloud computing and iot devices: Strategies for mitigation,” Kasu J. Comput. Sci., vol. 1, no. 4, pp. 778–795, 2024. [8] S. Neupane, J. Ables, W. Anderson, S. Mittal, S. Rahimi, I. Banicescu, and M. Seale, “Explainable intrusion detection systems (x-ids): A survey of current methods, challenges, and opportunities,” IEEE Access, vol. 10, pp. 112 392–112 415, 2022. [9] D. Gunning, “Explainable artificial intelligence (xai),” Defense advanced research projects agency (DARPA), nd Web, vol. 2, no. 2, p. 1, 2017. [10] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” Advances in neural information processing systems, vol. 30, 2017. [11] M. T. Ribeiro, S. Singh, and C. Guestrin, “Lime: Local interpretable model-agnostic explanations,” in Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining (KDD), 2016, pp. 2145–2154. [12] D. P. Möller, “Nist cybersecurity framework and mitre cybersecurity criteria,” in Guide to Cybersecurity in Digital Transformation: Trends, Methods, Technologies, Applications and Best Practices. Springer, 2023, pp. 231–271. [13] MITRE Corporation, “Enterprise ATT&CK matrix,” https://attack.mitre.org/matrices/enterprise/, 2025, accessed: May 12, 2026. [14] H. İpek and H. Yüksel, “The institutional and structural transformation of the european union agency for cybersecurity (enisa),” Journal of International Relations and Political Science Studies, no. 14, pp. 28– 64. [15] S. Robertson and H. Zaragoza, The probabilistic relevance framework: BM25 and beyond. Now Publishers Inc, 2009, vol. 4. [16] J. Johnson, M. Douze, and H. Jégou, “Billion-scale similarity search with gpus,” arXiv, 2017. [17] R. P. Lippmann, D. J. Fried, I. Graf, J. W. Haines, K. R. Kendall, D. McClung, D. Weber, S. E. Webster, D. Wyschogrod, R. K. Cunningham et al., “Evaluating intrusion detection systems: The 1998 darpa offline intrusion detection evaluation,” in Proceedings DARPA Information survivability conference and exposition. DISCEX’00, vol. 2. IEEE, 2000, pp. 12–26. [18] G. Kim, H. Yi, J. Lee, Y. Paek, and S. Yoon, “Lstm-based systemcall language modeling and robust ensemble method for designing hostbased intrusion detection systems,” arXiv preprint arXiv:1611.01726, 2016. [19] C. Yin, Y. Zhu, J. Fei, and X. He, “A deep learning approach for intrusion detection using recurrent neural networks,” Ieee Access, vol. 5, pp. 21 954–21 961, 2017. [20] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning approach to network intrusion detection,” IEEE transactions on emerging topics in computational intelligence, vol. 2, no. 1, pp. 41–50, 2018. [21] R. Vinayakumar, M. Alazab, K. Soman, P. Poornachandran, and A. AlNemrat, “Deep learning approach for intelligent intrusion detection system,” IEEE Access, vol. 7, pp. 41 525–41 550, 2019. [22] J. Lansky, S. Ali, M. Mohammadi, M. K. Majeed, S. H. T. Karim, S. Rashidi, M. Hosseinzadeh, and A. M. Rahmani, “Deep learning-based intrusion detection systems: a systematic review,” IEEE Access, vol. 9, pp. 101 574–101 599, 2021. [23] M. A. Ferrag, M. Ndhlovu, N. Tihanyi, L. C. Cordeiro, M. Debbah, T. Lestable, and N. S. Thandi, “Revolutionizing cyber threat detection with large language models: A privacy-preserving bert-based lightweight model for iot/iiot devices,” IEEe Access, vol. 12, pp. 23 733–23 750, 2024. [24] H. Huang and Y. Wang, “Secbert: Privacy-preserving pre-training based neural network inference system,” Neural Networks, vol. 172, p. 106135, 2024. [25] P. Ranade, A. Piplai, A. Joshi, and T. Finin, “Cybert: Contextualized embeddings for the cybersecurity domain,” in 2021 IEEE international conference on big data (Big Data). IEEE, 2021, pp. 3334–3342.

[26] M. Simoni, A. Saracino, V. P, and M. Conti, “Morse: Bridging the gap in cybersecurity expertise with retrieval augmented generation,” in Proceedings of the 40th ACM/SIGAPP Symposium on Applied Computing, 2025, pp. 1213–1222. [27] F. Blefari, C. Cosentino, F. A. Pironti, A. Furfaro, and F. Marozzo, “Cyberrag: An agentic rag cyber attack classification and reporting tool,” arXiv preprint arXiv:2507.02424, 2025. [28] V. Setiawan and B. Soewito, “Instruction-based chain-of-thought for multi-agent rag in snort rule generation.” International Journal of Intelligent Engineering & Systems, vol. 18, no. 11, 2025. [29] S. J. Pinto, P. Siano, and M. Parente, “Review of cybersecurity analysis in smart distribution systems and future directions for using unsupervised learning methods for cyber detection,” Energies, vol. 16, no. 4, p. 1651, 2023. [30] P. Loi, D. Canavese, L. Regano, D. Maiorca, and G. Giacinto, “Shap happens: an explainable ids for industrial iot networks,” in 2025 IEEE 9th Forum on Research and Technologies for Society and Industry (RTSI). IEEE, 2025, pp. 71–76. [31] G. Tjhai, D. Papamartzivanos, S. Furnell, and M. Papadaki, “Explaining the decisions of an intrusion detection system: A case study,” Journal of Information Security and Applications, vol. 68, p. 103233, 2022. [32] Y. LeCun and Y. Bengio, “Convolutional networks for images, speech, and time series,” The handbook of brain theory and neural networks, 1998. [33] D. E. Rumelhart, G. E. Hinton, and R. J. Williams, “Learning representations by back-propagating errors,” nature, vol. 323, no. 6088, pp. 533–536, 1986. [34] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” Neural computation, vol. 9, no. 8, pp. 1735–1780, 1997. [35] C. Cortes and V. Vapnik, “Support-vector networks,” Machine learning, vol. 20, no. 3, pp. 273–297, 1995. [36] L. Breiman, “Random forests,” Machine learning, vol. 45, no. 1, pp. 5–32, 2001. [37] T. Sandaruwan, J. Wijayanayake, and J. Senanayake, “Leveraging large language models in cybersecurity: A systematic review of emerging methods and techniques,” DRC, p. 155, 2024. [38] European Union Agency for Cybersecurity, “Soc good practices: Operational controls and workflows for security operations centres,” ENISA, Tech. Rep., 2022, accessed: 2026-05-14. [Online]. Available: https://www.enisa.europa.eu/publications/soc-good-practices [39] N. Moustafa and J. Slay, “Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set),” in 2015 military communications and information systems conference (MilCIS). IEEE, 2015, pp. 1–6. [40] R. Garreta, G. Moncecchi, T. Hauck, and G. Hackeling, Scikit-learn: machine learning simplified: implement scikit-learn into every step of the data science pipeline. Packt Publishing Ltd, 2017. [41] C. Yuan and S. S. Agaian, “A comprehensive review of binary neural network,” Artificial Intelligence Review, vol. 56, no. 11, pp. 12 949– 13 013, 2023. [42] Y.-D. Zhang, C. Pan, J. Sun, and C. Tang, “Multiple sclerosis identification by convolutional neural network with dropout and parametric relu,” Journal of computational science, vol. 28, pp. 1–10, 2018. [43] W. Jung, D. Jung, B. Kim, S. Lee, W. Rhee, and J. H. Ahn, “Restructuring batch normalization to accelerate cnn training,” Proceedings of machine learning and systems, vol. 1, pp. 14–26, 2019. [44] X. Liang, X. Wang, Z. Lei, S. Liao, and S. Z. Li, “Soft-margin softmax for deep classification,” in International Conference on Neural Information Processing. Springer, 2017, pp. 413–421. [45] Z. Xu, C. Dan, J. Khim, and P. Ravikumar, “Class-weighted classification: Trade-offs and robust approaches,” in International conference on machine learning. PMLR, 2020, pp. 10 544–10 554. [46] R. Mohammed, J. Rawashdeh, and M. Abdullah, “Machine learning with oversampling and undersampling techniques: overview study and experimental results,” in 2020 11th international conference on information and communication systems (ICICS). IEEE, 2020, pp. 243–248. [47] D. P. Kingma and J. Ba, “Adam: A method for stochastic optimization,” arXiv preprint arXiv:1412.6980, 2014. [48] M. Ancona, E. Ceolini, C. Öztireli, and M. Gross, “Gradient-based attribution methods,” in Explainable AI: Interpreting, explaining and visualizing deep learning. Springer, 2019, pp. 169–191. [49] X. Liu, J. Wang, X. Yuan, J. Sun, G. Dong, P. Di, W. Wang, and D. Wang, “Prompting frameworks for large language models: A survey,” ACM Computing Surveys, 2023.

[50] L. Peel, D. B. Larremore, and A. Clauset, “The ground truth about metadata and community detection in networks,” Science advances, vol. 3, no. 5, p. e1602548, 2017. [51] M. Y. AlYousef and N. T. Abdelmajeed, “Dynamically detecting security threats and updating a signature-based intrusion detection system’s database,” Procedia Computer Science, vol. 159, pp. 1507–1516, 2019. [52] R. Qu, R. Tu, and F. Bao, “Is semantic chunking worth the computational cost?” in Findings of the Association for Computational Linguistics: NAACL 2025, 2025, pp. 2155–2177. [53] C. Galli, N. Donos, and E. Calciolari, “Performance of 4 pre-trained sentence transformer models in the semantic query of a systematic review dataset on peri-implantitis,” Information, vol. 15, no. 2, p. 68, 2024. [54] D. Danopoulos, C. Kachris, and D. Soudris, “Approximate similarity search with faiss framework using fpgas on the cloud,” in International Conference on Embedded Computer Systems. Springer, 2019, pp. 373– 386. [55] D. Gunawan, C. Sembiring, and M. A. Budiman, “The implementation of cosine similarity to calculate text relevance between two documents,” in Journal of physics: conference series, vol. 978, no. 1. IOP Publishing, 2018, p. 012120. [56] S. Ravishankar and P. Varalakshmi, “Novel hybrid retrieval and reranking with score fusion for advanced financial question answering using large language models,” in 2025 IEEE Silchar Subsection Conference (SILCON). IEEE, 2025, pp. 1–6. [57] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar et al., “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023. [58] F. S. Marcondes, A. Gala, R. Magalhães, F. Perez de Britto, D. Durães, and P. Novais, “Using ollama,” in Natural Language Analytics with Generative Large-Language Models: A Practical Approach with Ollama and Open-Source LLMs. Springer, 2025, pp. 23–35. [59] D. Bodeau and R. Graubart, “Cyber resiliency and nist special publication 800-53 rev. 4 controls,” 2013. [60] National Institute of Standards and Technology, “Security and privacy controls for information systems and organizations,” U.S. Department of Commerce, Gaithersburg, MD, Tech. Rep. NIST SP 800-53, Revision 5, 2020. [Online]. Available: https://doi.org/10.6028/NIST.SP.800-53r5 [61] IAB, “Rfc 4732: Internet denial-of-service considerations,” 2006. [62] The MITRE Corporation, “Common weakness enumeration (cwe) version 4.19.1,” https://cwe.mitre.org/data/index.html, January 2026, accessed: April 29, 2026. [63] H. Chase, “LangChain,” Oct. 2022. [Online]. Available: https://github.com/langchain-ai/langchain [64] Ollama Team, “Ollama,” 2024. [Online]. Available: https://ollama.com [65] OpenAI, “text-embedding-ada-002: Openai embedding model,” https://platform.openai.com/docs/guides/embeddings, 2022. [66] Canadian Institute for Cybersecurity, “CICIDS2018 intrusion detection dataset,” https://www.unb.ca/cic/datasets/ids-2018.html, 2018. [67] J. L. Leevy, J. Hancock, R. Zuech, and T. M. Khoshgoftaar, “Detecting cybersecurity attacks across different network features and learners,” Journal of Big Data, vol. 8, no. 1, p. 38, 2021. [68] ISO/IEC, “Information technology — information security incident management — part 1: Principles and process,” International Organization for Standardization, Geneva, Switzerland, Tech. Rep. ISO/IEC 27035-1:2023, 2023. [Online]. Available: https://www.iso.org/standard/78973.html [69] T. Zhang, V. Kishore, F. Wu, K. Q. Weinberger, and Y. Artzi, “Bertscore: Evaluating text generation with bert,” arXiv preprint arXiv:1904.09675, 2019. [70] C.-Y. Lin, “Rouge: A package for automatic evaluation of summaries,” in Text summarization branches out, 2004, pp. 74–81. [71] M. Post, “A call for clarity in reporting bleu scores,” in Proceedings of the third conference on machine translation: Research papers, 2018, pp. 186–191. [72] F. Wilcoxon, “Individual comparisons by ranking methods,” Biometrics Bulletin, vol. 1, no. 6, pp. 80–83, 1945.