Computer Network Security Report Generation with RAG and Small Language Models

• Diego das Neves Nascimento UFAPE
• Tiago Buarque Assunção de Carvalho UFAPE
• Sérgio Francisco Tavares de Oliveira Mendonça UFAPE

DOI: https://doi.org/10.5753/eniac.2026.29753

Resumo

Computer network monitoring is a crucial activity for institutional security; however, many organizations face a shortage of specialists to operationalize this infrastructure. To mitigate this issue, this paper presents a proof of concept of a Retrieval-Augmented Generation (RAG) pipeline executed 100% locally on CPU for incident detection and mitigation. The system utilizes Small Language Models (SLMs) for structured report generation. Experimental results demonstrate the technical viability of the approach under severe hardware constraints. The pipeline achieved 100% MITRE technique identification within the evaluated attack categories and 70% precision in extracting the corresponding defensive safeguards.

Referências

Barros, C., Lima, J., Arruda, A., Sousa, R., and Bandeira, A. (2025). Simplificação da análise forense de logs utilizando grandes modelos de linguagem com a técnica rag. In Anais do XXV Simpósio Brasileiro de Cibersegurança, pages 839–854. SBC.

Brasil (2018). Lei nº 13.709, de 14 de agosto de 2018. lei geral de proteção de dados pessoais (lgpd).

Brasil (2025). Portaria sgd/mgi nº 9.511, de 28 de outubro de 2025. institui o ppsi 2.0. Ministério da Gestão e da Inovação em Serviços Públicos.

Brasil (2026). Acórdão 258/2026 — tcu — plenário. acompanhamento da governança e gestão de ti nas ifes. Tribunal de Contas da União.

CIS (2022). Cis controls v8 master mapping to mitre enterprise att&ck v8.2. Technical report, Center for Internet Security.

Cormack, G. V., Clarke, C. L. A., and Büttcher, S. (2009). Reciprocal rank fusion outperforms condorcet and individual rank learning methods. 32nd international ACM SIGIR conference on Research and development in information retrieval.

Corradini, F., Leonesi, M., and Piangerelli, M. (2025). State of the art and future directions of small language models: A systematic review. Big Data and Cognitive Computing, 9:189.

da Silva Júnior, A. C. C., Quincozes, S. E., Cattelan, R. G., and Miani, R. S. (2024). Robustness of machine learning-based intrusion detection systems against adversarial attacks in cyber-physical systems. In Anais do XXI Encontro Nacional de Inteligência Artificial e Computacional (ENIAC 2024), pages 227–238.

Daniel, N., Kaiser, F. K., Giladi, S., Sharabi, S., Moyal, R., Shpolyansky, S., Murillo, A., Elyashar, A., and Puzis, R. (2025). Labeling network intrusion detection system (nids) rules with mitre att&ck techniques: Machine learning vs. large language models. Big Data and Cognitive Computing, 9:23.

dos Santos Almeida, L., Spredemann, F., Morales, A. S., Rodrigues-Filho, R., and Panisson, A. R. (2025). Towards a network intrusion classification system using machine learning. In Anais do XXII Encontro Nacional de Inteligência Artificial e Computacional (ENIAC 2025), pages 1914–1925.

Freitas, C. et al. (2024). Enhancing epidemiological insights with rag. In Anais do Encontro Nacional de Inteligência Artificial e Computacional (ENIAC).

Houssel, P. R. B., Singh, P., Layeghy, S., and Portmann, M. (2024). Towards explainable network intrusion detection using large language models. In 2024 IEEE/ACM International Conference on Big Data Computing, Applications and Technologies (BDCAT), pages 67–72. IEEE.

Jones, G., Kasimatis, D., Pitropakis, N., Macfarlane, R., and Buchanan, W. (2025). Analysing the role of llms in cybersecurity incident management: Analysing the role of llms in cybersecurity incident managementg. jones et al. International Journal of Information Security, 24.

Jüttner, V., Rennekamp, T., Kliem, D., Linke, M., and Reuter, C. (2024). Chatids: Advancing explainable cybersecurity using generative ai. In 2024 IEEE International Conference on Communications (ICC). IEEE.

Khan, F. A., Shah, A. A., Alshammry, N., Saif, S., Khan, W., Malik, M. O., and Ullah, Z. (2024). Balanced multi-class network intrusion detection using machine learning. IEEE Access, 12:178222–178236.

Melhem, S., Golec, M., Alwarafy, A., and Khamayseh, Y. (2025). Lens: Lightweight and explainable llm-based apt detection at the edge for 6g security. IEEE Access, 13:172402–172415.

Novais, M. et al. (2024). Enhancing legal question answering with small models. In Anais do Encontro Nacional de Inteligência Artificial e Computacional (ENIAC).

Paduraru, C. et al. (2025). Automated generation of cybersecurity response playbooks via large language models. Procedia Computer Science, 270:2987–2996. KES International 2025.

Perrina, F., Marchiori, F., Conti, M., and Verde, N. V. (2023). Agir: Automating cyber threat intelligence reporting with natural language generation. In 2023 IEEE International Conference on Big Data (BigData), pages 3053–3062.

Rocha, R. and Pessoa, M. (2024). Advanced rag for local llms. In Anais do Encontro Nacional de Inteligência Artificial e Computacional (ENIAC).

Sharafaldin, I., Lashkari, A. H., and Ghorbani, A. A. (2018). Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP), pages 108–116.

Zitei, M. et al. (2024). Open-world text classification with small language models. In Anais do Encontro Nacional de Inteligência Artificial e Computacional (ENIAC).