mlsanityData to 14 Oct 2026

From Detection to Response: A Deep Learning and Retrieval-Augmented Generation Framework for Network Intrusion Mitigation

arXiv 2605.17960 ↗First posted 18 May 2026cs.CRcited by 0

On the map: Retrieval-augmented generation → Privacy and security of RAG

Abstract (arXiv)

Machine-learning-based Intrusion Detection Systems (IDS) have achieved impressive accuracy in classifying network attacks, yet they consistently fall short on the question that matters most to a security analyst: what should I do next? This paper presents a unified, end-to-end framework that closes the gap between threat detection and actionable response. The system operates in two tightly coupled stages. First, an ensemble of three independently trained binary Deep Neural Networks (DNNs) classifies network traffic flows as Benign, Denial of Service (DoS), or Distributed Denial of Service (DDoS), achieving 99.84% accuracy on the CICIDS2018 dataset and 95.30% on the UNSW-NB15 dataset. Second, a Retrieval-Augmented Generation (RAG) pipeline constructs explanation-aware prompts from the top-5 anomalous features, retrieves the most semantically and lexically relevant guidance from a knowledge base derived from authorized sources and di- rects a locally deployed language model to synthesise structured, citation-grounded mitigation reports. The RAG-enhanced reports outperform vanilla LLM outputs across all automated evaluation metrics.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Privacy and security of RAG, one of 15 directions in Retrieval-augmented generation. Builds on 18 of its 70 references that are in the map. First posted on arXiv 18 May 2026.

Builds on

18 of 70 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025CyberRAG: An Agentic RAG cyber attack classification and reporting tool3 Jul
  2. 2024MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation22 Jul

Other references · 16

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  3. 2020Retrieval-Augmented Generation for Knowledge-Intensive NLP Taskscited by 9,297
  4. 2017A Unified Approach to Interpreting Model Predictionscited by 6,555
  5. 2019BERTScore: Evaluating Text Generation with BERTcited by 5,512
  6. 2017Billion-scale similarity search with GPUscited by 2,497
  7. 2018A Call for Clarity in Reporting BLEU Scorescited by 1,799
  8. 2021A comprehensive review of Binary Neural Networkcited by 45
  9. 2024Is Semantic Chunking Worth the Computational Cost?cited by 43
  10. 2016The ground truth about metadata and community detection in networkscited by 42
  11. 2023Revolutionizing Cyber Threat Detection with Large Language Models: A privacy-preserving BERT-based Lightweight Model for IoT/IIoT Devicescited by 39
  12. 2020Class-Weighted Classification: Trade-offs and Robust Approachescited by 30
4 more
  1. 2023Prompting Frameworks for Large Language Models: A Surveycited by 29
  2. 2022Explainable Intrusion Detection Systems (X-IDS): A Survey of Current Methods, Challenges, and Opportunitiescited by 25
  3. 2018Restructuring Batch Normalization to Accelerate CNN Trainingcited by 12
  4. 2016LSTM-Based System-Call Language Modeling and Robust Ensemble Method for Designing Host-Based Intrusion Detection Systemscited by 9

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Defending Retrieval-Augmented Intrusion Detection Against Knowledge Poisoning and Prompt Injection
  2. 2024A Review of the Duality of Adversarial Learning in Network Intrusion: Attacks and Countermeasures ↗
  3. 2026Intelligent Detection and Mitigation of Carpet-Bombing DDoS Attacks in SDN Using Retrieval-Augmented Generation and Large Language Models
  4. 2025ReGAIN: Retrieval-Grounded AI Framework for Network Traffic Analysis
  5. 2024Towards Explainable Network Intrusion Detection using Large Language Models
  6. 2025On Automating Security Policies with Contemporary LLMs
  7. 2025Advancing Autonomous Incident Response: Leveraging LLMs and Cyber Threat Intelligence
  8. 2026Attribution-Driven Explainable Intrusion Detection with Encoder-Based Large Language Models