{"id":"https://openalex.org/W7162139330","doi":"https://doi.org/10.1145/3786335.3813136","title":"Retrieval-Augmented LLMs for Security Incident Analysis","display_name":"Retrieval-Augmented LLMs for Security Incident Analysis","publication_year":2026,"publication_date":"2026-05-22","ids":{"openalex":"https://openalex.org/W7162139330","doi":"https://doi.org/10.1145/3786335.3813136"},"language":null,"primary_location":{"id":"doi:10.1145/3786335.3813136","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786335.3813136","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Conference on AI and Agentic Systems","raw_type":"proceedings-article"},"type":"article","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://doi.org/10.1145/3786335.3813136","any_repository_has_fulltext":null},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5120688486","display_name":"Xavier Cadet","orcid":null},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xavier Cadet","raw_affiliation_strings":["Dartmouth College, Hanover, NH, USA"],"raw_orcid":"https://orcid.org/0000-0002-8545-0371","affiliations":[{"raw_affiliation_string":"Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5123142900","display_name":"Aditya Vikram Singh","orcid":null},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Aditya Vikram Singh","raw_affiliation_strings":["Northeastern University, Boston, MA, USA"],"raw_orcid":"https://orcid.org/0009-0009-8365-0503","affiliations":[{"raw_affiliation_string":"Northeastern University, Boston, MA, USA","institution_ids":["https://openalex.org/I12912129"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136770190","display_name":"Harsh Mamania","orcid":"https://orcid.org/0009-0001-4680-5686"},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Harsh Mamania","raw_affiliation_strings":["Northeastern University, Boston, MA, USA"],"raw_orcid":"https://orcid.org/0009-0001-4680-5686","affiliations":[{"raw_affiliation_string":"Northeastern University, Boston, MA, USA","institution_ids":["https://openalex.org/I12912129"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002242164","display_name":"Edward Koh","orcid":null},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Edward Koh","raw_affiliation_strings":["Dartmouth College, Hanover, NH, USA"],"raw_orcid":"https://orcid.org/0009-0004-2049-6274","affiliations":[{"raw_affiliation_string":"Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136763640","display_name":"Alex Fitts","orcid":"https://orcid.org/0000-0002-8928-6011"},"institutions":[{"id":"https://openalex.org/I4210088367","display_name":"Systems Analytics (United States)","ror":"https://ror.org/005ksdp35","country_code":"US","type":"company","lineage":["https://openalex.org/I4210088367"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Alex Fitts","raw_affiliation_strings":["PUNCH Cyber Analytics, Reston, VA, USA"],"raw_orcid":"https://orcid.org/0000-0002-8928-6011","affiliations":[{"raw_affiliation_string":"PUNCH Cyber Analytics, Reston, VA, USA","institution_ids":["https://openalex.org/I4210088367"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5037901627","display_name":"Dirk Van Bruggen","orcid":"https://orcid.org/0000-0001-9436-5200"},"institutions":[{"id":"https://openalex.org/I4210088367","display_name":"Systems Analytics (United States)","ror":"https://ror.org/005ksdp35","country_code":"US","type":"company","lineage":["https://openalex.org/I4210088367"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dirk Van Bruggen","raw_affiliation_strings":["PUNCH Cyber Analytics, Reston, VA, USA"],"raw_orcid":"https://orcid.org/0009-0000-4388-9653","affiliations":[{"raw_affiliation_string":"PUNCH Cyber Analytics, Reston, VA, USA","institution_ids":["https://openalex.org/I4210088367"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025677911","display_name":"Simona Boboila","orcid":"https://orcid.org/0009-0003-3411-8912"},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Simona Boboila","raw_affiliation_strings":["Northeastern University, Boston, MA, USA"],"raw_orcid":"https://orcid.org/0009-0003-3411-8912","affiliations":[{"raw_affiliation_string":"Northeastern University, Boston, MA, USA","institution_ids":["https://openalex.org/I12912129"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136795968","display_name":"Peter Chin","orcid":"https://orcid.org/0000-0002-1913-4223"},"institutions":[{"id":"https://openalex.org/I107672454","display_name":"Dartmouth College","ror":"https://ror.org/049s0rh22","country_code":"US","type":"education","lineage":["https://openalex.org/I107672454"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Peter Chin","raw_affiliation_strings":["Dartmouth College, Hanover, NH, USA"],"raw_orcid":"https://orcid.org/0000-0002-1913-4223","affiliations":[{"raw_affiliation_string":"Dartmouth College, Hanover, NH, USA","institution_ids":["https://openalex.org/I107672454"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5136794422","display_name":"Alina Oprea","orcid":"https://orcid.org/0000-0002-4979-5292"},"institutions":[{"id":"https://openalex.org/I12912129","display_name":"Northeastern University","ror":"https://ror.org/04t5xt781","country_code":"US","type":"education","lineage":["https://openalex.org/I12912129"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Alina Oprea","raw_affiliation_strings":["Northeastern University, Boston, MA, USA"],"raw_orcid":"https://orcid.org/0000-0002-4979-5292","affiliations":[{"raw_affiliation_string":"Northeastern University, Boston, MA, USA","institution_ids":["https://openalex.org/I12912129"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":9,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":{"value":0.82669875,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"103","last_page":"123"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.5638999938964844,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T12127","display_name":"Software System Performance and Reliability","score":0.5638999938964844,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.24500000476837158,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12034","display_name":"Digital and Cyber Forensics","score":0.041099999099969864,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/malware","display_name":"Malware","score":0.6836000084877014},{"id":"https://openalex.org/keywords/context","display_name":"Context (archaeology)","score":0.6281999945640564},{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.5582000017166138},{"id":"https://openalex.org/keywords/directory","display_name":"Directory","score":0.5234000086784363},{"id":"https://openalex.org/keywords/authentication","display_name":"Authentication (law)","score":0.4805999994277954},{"id":"https://openalex.org/keywords/network-security","display_name":"Network security","score":0.3978999853134155},{"id":"https://openalex.org/keywords/security-analysis","display_name":"Security analysis","score":0.39419999718666077},{"id":"https://openalex.org/keywords/hacker","display_name":"Hacker","score":0.366100013256073}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7002000212669373},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.6836000084877014},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6528000235557556},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.6281999945640564},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.5582000017166138},{"id":"https://openalex.org/C2777683733","wikidata":"https://www.wikidata.org/wiki/Q201456","display_name":"Directory","level":2,"score":0.5234000086784363},{"id":"https://openalex.org/C148417208","wikidata":"https://www.wikidata.org/wiki/Q4825882","display_name":"Authentication (law)","level":2,"score":0.4805999994277954},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.3978999853134155},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.39419999718666077},{"id":"https://openalex.org/C86844869","wikidata":"https://www.wikidata.org/wiki/Q2798820","display_name":"Hacker","level":2,"score":0.366100013256073},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.36340001225471497},{"id":"https://openalex.org/C71745522","wikidata":"https://www.wikidata.org/wiki/Q2476929","display_name":"Confidentiality","level":2,"score":0.3474999964237213},{"id":"https://openalex.org/C100660578","wikidata":"https://www.wikidata.org/wiki/Q18733","display_name":"Recall","level":2,"score":0.3050999939441681},{"id":"https://openalex.org/C154908896","wikidata":"https://www.wikidata.org/wiki/Q2167404","display_name":"Security policy","level":2,"score":0.3003000020980835},{"id":"https://openalex.org/C108759981","wikidata":"https://www.wikidata.org/wiki/Q788590","display_name":"Authorization","level":2,"score":0.29980000853538513},{"id":"https://openalex.org/C527648132","wikidata":"https://www.wikidata.org/wiki/Q189900","display_name":"Information security","level":2,"score":0.2919999957084656},{"id":"https://openalex.org/C110875604","wikidata":"https://www.wikidata.org/wiki/Q75","display_name":"The Internet","level":2,"score":0.28349998593330383},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2727999985218048},{"id":"https://openalex.org/C23123220","wikidata":"https://www.wikidata.org/wiki/Q816826","display_name":"Information retrieval","level":1,"score":0.26460000872612},{"id":"https://openalex.org/C2778062554","wikidata":"https://www.wikidata.org/wiki/Q3404031","display_name":"Security community","level":2,"score":0.257099986076355},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.2565000057220459}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3786335.3813136","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786335.3813136","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Conference on AI and Agentic Systems","raw_type":"proceedings-article"}],"best_oa_location":{"id":"doi:10.1145/3786335.3813136","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3786335.3813136","pdf_url":null,"source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the ACM Conference on AI and Agentic Systems","raw_type":"proceedings-article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/8","score":0.41719603538513184,"display_name":"Decent work and economic growth"}],"awards":[{"id":"https://openalex.org/G742517347","display_name":null,"funder_award_id":"W912CG23C0031","funder_id":"https://openalex.org/F4320337531","funder_display_name":"Defense Sciences Office, DARPA"}],"funders":[{"id":"https://openalex.org/F4320337531","display_name":"Defense Sciences Office, DARPA","ror":"https://ror.org/0447fe631"}],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":14,"referenced_works":["https://openalex.org/W4319079731","https://openalex.org/W4389984066","https://openalex.org/W4392849751","https://openalex.org/W4398239377","https://openalex.org/W4402502890","https://openalex.org/W4404407704","https://openalex.org/W4406058732","https://openalex.org/W4408343551","https://openalex.org/W4410397683","https://openalex.org/W4414594130","https://openalex.org/W4414806448","https://openalex.org/W4414825143","https://openalex.org/W7077867983","https://openalex.org/W7102413077"],"related_works":[],"abstract_inverted_index":{"Investigating":[0],"cybersecurity":[1],"incidents":[2,101],"requires":[3],"collecting":[4],"and":[5,19,38,57,86,102,115,123,144,166],"analyzing":[6],"evidence":[7],"from":[8,75],"multiple":[9],"log":[10],"sources,":[11],"including":[12],"intrusion":[13],"detection":[14,157],"alerts,":[15],"network":[16],"traffic":[17,100],"records,":[18],"authentication":[20],"events.":[21],"This":[22],"process":[23],"is":[24],"labor-intensive:":[25],"analysts":[26],"must":[27],"sift":[28],"through":[29,53],"large":[30],"volumes":[31],"of":[32],"data":[33],"to":[34,72,82,168],"identify":[35],"relevant":[36,80],"indicators":[37,74],"piece":[39],"together":[40],"what":[41],"happened.":[42],"We":[43,90,108],"present":[44],"a":[45,64,103],"RAG-based":[46,184],"system":[47,62,93],"that":[48,110,178],"performs":[49],"security":[50,192],"incident":[51],"analysis":[52,193],"targeted":[54,180],"query-based":[55,181],"filtering":[56,182],"LLM":[58,96,195],"semantic":[59],"reasoning.":[60],"The":[61],"uses":[63],"query":[65],"library":[66],"with":[67,94,117,171,183],"associated":[68],"MITRE":[69],"ATT&CK":[70],"techniques":[71],"extract":[73],"raw":[76],"logs,":[77],"then":[78],"retrieves":[79],"context":[81,196],"answer":[83],"forensic":[84],"questions":[85],"reconstruct":[87],"attack":[88],"sequences.":[89],"evaluate":[91],"the":[92,159],"eight":[95],"configurations":[97],"on":[98,158],"malware":[99,132],"multi-stage":[104],"Active":[105,160],"Directory":[106,161],"attack.":[107],"find":[109],"LLMs":[111],"have":[112],"different":[113],"performance":[114],"tradeoffs,":[116],"Claude":[118,141],"Sonnet":[119],"4":[120],"achieving":[121,126],"94%":[122],"DeepSeek":[124,135],"V3":[125],"89%":[127],"average":[128],"recall":[129,150,170],"across":[130],"17":[131],"scenarios,":[133],"while":[134],"costs":[136],"15":[137],"\u00d7":[138],"less":[139],"than":[140],"per":[142],"analysis,":[143],"locally-deployed":[145],"Llama":[146],"3.1:70b":[147],"achieves":[148],"81%":[149],"at":[151],"zero":[152],"per-query":[153],"cost.":[154],"Attack":[155],"step":[156],"scenario":[162],"reaches":[163],"100%":[164],"precision":[165],"up":[167],"96%":[169],"an":[172],"enumeration":[173],"prompt.":[174],"These":[175],"results":[176],"demonstrate":[177],"combining":[179],"retrieval\u2014confirmed":[185],"essential":[186],"by":[187],"ablation":[188],"studies\u2014enables":[189],"accurate,":[190],"cost-effective":[191],"within":[194],"limits.":[197]},"counts_by_year":[],"updated_date":"2026-06-11T09:08:48.828518","created_date":"2026-05-23T00:00:00"}