ZeroLINC: Training-Free Local Classification of Security Incident Reports - Kapelinski, Cristhian; Machado, Beatriz; Kreutz, Diego (Anais Estendidos do Simpósio Brasileiro de Cibersegurança (SBSeg); 2026: Anais Estendidos do XXVI Simpósio Brasileiro de CibersegurançaDO - 10.5753/sbseg_estendido.2026.33502, 2026)
Security operations centers must classify large volumes of incident reports. Recent work automates this by prompting commercial large language models (LLMs), which charge per call and receive sensitive incident data, or locally hosted models with billions of parameters, which demand a GPU server. We present ZeroLINC, an open-source tool that lets a SOC or CSIRT analyst assign each incoming report to one of 12 NIST categories on a single local GPU, with no gradient training and no external API. Its instance-memory engine labels each ticket by similarity to the nearest already-labeled tickets. With 89 labeled examples it reaches 90.8% mean test accuracy over the eight categories the corpus populates (p < 0.001 against the majority baseline), matching the band that prior work reached only with a commercial LLM. A second engine works with no labeled data at all, up to 70.9%. We selected the engines with a systematic benchmark of 293 runs on 182 expert-labeled tickets from real incident response teams. Classifying the whole corpus takes seconds and under 3 Wh on one GPU.