Retrieval-Augmented LLMs for Security Incident Analysis

Dimensions overall score 8.0

GitHub Code Pulse

No public code linked for this paper yet.

• A RAG-based system combining targeted query-based filtering with LLM semantic reasoning can perform security incident analysis by extracting indicators from raw logs and reconstructing attack sequences.method 95%
• Claude Sonnet 4 and DeepSeek V3 achieved 100% recall across all four malware traffic scenarios in their evaluation.result 92%
• DeepSeek costs 15× less than other LLM providers for security incident analysis ($0.008 vs. $0.12 per analysis).result 91%
• Attack step detection on Active Directory scenarios reaches 100% precision and 82% recall.result 93%
• A RAG architecture is essential for security incident analysis, as LLM baselines without RAG-enhanced context miss critical attack infrastructure.technical 90%
• The system uses a query library with associated MITRE ATT&CK techniques to extract indicators from raw logs.method 88%
• Different LLM models have different performance and tradeoffs for security incident analysis tasks.result 85%
• The RAG-based approach enables accurate, cost-effective security analysis within LLM context limits.technical 87%

Competitive landscape

Competitor map is still being generated for this paper. Enable generation or check back soon.

Startup potential card