GenDFIR: Advancing Cyber Incident Timeline Analysis Through Retrieval Augmented Generation and Large Language Models
On the map: Retrieval-augmented generation → Privacy and security of RAG
Abstract (arXiv)
Cyber timeline analysis, or forensic timeline analysis, is crucial in Digital Forensics and Incident Response (DFIR). It examines artefacts and events particularly timestamps and metadata to detect anomalies, establish correlations, and reconstruct incident timelines. Traditional methods rely on structured artefacts, such as logs and filesystem metadata, using specialised tools for evidence identification and feature extraction. This paper introduces GenDFIR, a framework leveraging large language models (LLMs), specifically Llama 3.1 8B in zero shot mode, integrated with a Retrieval-Augmented Generation (RAG) agent. Incident data is preprocessed into a structured knowledge base, enabling the RAG agent to retrieve relevant events based on user prompts. The LLM interprets this context, offering semantic enrichment. Tested on synthetic data in a controlled environment, results demonstrate GenDFIR's reliability and robustness, showcasing LLMs potential to automate timeline analysis and advance threat detection.
Key facts. Cited by 7 papers in the map (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. First posted on arXiv 4 Sep 2024.
Builds on
0 of 0 references.
No references here yet.
Built on by
Citing papers per year: 2024: 1; 2025: 3; 2026: 3.
7 papers.
- 2024Advanced Persistent Threats (APT) Attribution Using Deep Reinforcement Learningcited by 6
- 2025DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Responsecited by 4
- 2025AutoBnB-RAG: Enhancing Multi-Agent Incident Response with Retrieval-Augmented Generationcited by 3
- 2025A Robust Cross-Domain IDS using BiGRU-LSTM-Attention for Medical and Industrial IoT Securitycited by 2
- 2026TxRay: Agentic Postmortem of Live Blockchain Attackscited by 2
- 2026Automated Post-Incident Policy Gap Analysis via Threat-Informed Evidence Mapping using Large Language Modelscited by 1
- 2026Semantic Layer Induction from Raw Telemetry via Hierarchical LLM and RAG Abstractioncited by 0
- 2026Semantic Layer Induction from Raw Telemetry via Hierarchical LLM and RAG Abstraction17 Sep 2026
- 2026TxRay: Agentic Postmortem of Live Blockchain Attacks1 Feb 2026
- 2026Automated Post-Incident Policy Gap Analysis via Threat-Informed Evidence Mapping using Large Language Models4 Jan 2026
- 2025AutoBnB-RAG: Enhancing Multi-Agent Incident Response with Retrieval-Augmented Generation18 Aug 2025
- 2025A Robust Cross-Domain IDS using BiGRU-LSTM-Attention for Medical and Industrial IoT Security17 Aug 2025
- 2025DFIR-Metric: A Benchmark Dataset for Evaluating Large Language Models in Digital Forensics and Incident Response26 May 2025
- 2024Advanced Persistent Threats (APT) Attribution Using Deep Reinforcement Learning15 Oct 2024
Similar, not cited
Close in wording, no citation either way
- 2025Adapting Large Language Models to Emerging Cybersecurity using Retrieval Augmented Generation
- 2026Retrieval-Augmented LLMs for Security Incident Analysis
- 2025Chances and Challenges of the Model Context Protocol in Digital Forensics and Incident Response
- 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence
- 2026LLMs for Zero-Shot Threat Detection via Structured Risk Indicators
- 2023Advancing TTP Analysis: Harnessing the Power of Large Language Models with Retrieval Augmented Generation
- 2025Traceback of Poisoning Attacks to Retrieval-Augmented Generation
- 2026Bridging the First-Hour Gap: Evaluating AI Reliability and Benchmarking Deficiencies in Cyber Incident Response for Law Enforcement ↗