ZeroLINC: Training-Free Local Classification of Security Incident Reports

• Cristhian Kapelinski UNIPAMPA https://orcid.org/0009-0005-5750-022X
• Beatriz Machado UNIPAMPA https://orcid.org/0009-0002-2750-0323
• Diego Kreutz UNIPAMPA https://orcid.org/0000-0003-0830-0238

DOI: https://doi.org/10.5753/sbseg_estendido.2026.33502

Resumo

Security operations centers must classify large volumes of incident reports. Recent work automates this by prompting commercial large language models (LLMs), which charge per call and receive sensitive incident data, or locally hosted models with billions of parameters, which demand a GPU server. We present ZeroLINC, an open-source tool that lets a SOC or CSIRT analyst assign each incoming report to one of 12 NIST categories on a single local GPU, with no gradient training and no external API. Its instance-memory engine labels each ticket by similarity to the nearest already-labeled tickets. With 89 labeled examples it reaches 90.8% mean test accuracy over the eight categories the corpus populates (p < 0.001 against the majority baseline), matching the band that prior work reached only with a commercial LLM. A second engine works with no labeled data at all, up to 70.9%. We selected the engines with a systematic benchmark of 293 runs on 182 expert-labeled tickets from real incident response teams. Classifying the whole corpus takes seconds and under 3 Wh on one GPU.

Referências

Aarab, I. (2026). BTZSC: A benchmark for zero-shot text classification across crossencoders, embedding models, rerankers and LLMs. In ICLR.

Almeida, G. et al. (2025). On-premise SLMs vs. commercial LLMs: Prompt engineering and incident classification in SOCs and CSIRTs. In ERRC.

Chen, J. et al. (2024). M3-Embedding: Multi-linguality, multi-functionality, multi-granularity text embeddings through self-knowledge distillation. arXiv:2402.03216.

Conneau, A. et al. (2020). Unsupervised cross-lingual representation learning at scale. In ACL.

Habibzadeh, A., Feyzi, F., and Ebrahimi Atani, R. (2025). Large language models for security operations centers: A comprehensive survey. arXiv:2509.10858.

He, P., Gao, J., and Chen, W. (2023). DeBERTaV3: Improving DeBERTa using ELECTRA-style pre-training with gradient-disentangled embedding sharing. In ICLR.

Ibrishimova, M. D. (2019). Cyber incident classification: Issues and challenges. In 3PG-CIC.

Laurer, M. et al. (2024a). Building efficient universal classifiers with natural language inference. arXiv:2312.17543.

Laurer, M. et al. (2024b). Less annotating, more classifying: Addressing the data scarcity issue of supervised machine learning with deep transfer learning and BERT-NLI. Political Analysis, 32(1).

Lewis, M. et al. (2020). BART: Denoising sequence-to-sequence pre-training for natural language generation, translation, and comprehension. In ACL.

Nasution, A. H. et al. (2025). Benchmarking 21 open-source large language models for phishing link detection with prompt engineering. Information, 16.

Ndichu, S., Ban, T., Ozawa, S., Takahashi, T., and Inoue, D. (2026). AI-driven security alert screening and alert fatigue mitigation in security operations centers: A survey. arXiv:2605.08316.

Nelson, A. et al. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile. Technical Report SP 800-61r3, NIST.

Severo, A. S. P. et al. (2025a). Categorização de incidentes de segurança utilizando engenharia de prompts em LLMs. In SBSeg.

Severo, A. S. P. et al. (2025b). LLMs e Engenharia de Prompt para Classificação Automatizada de Incidentes em SOCs. In SBSeg (Extended).

Snell, J., Swersky, K., and Zemel, R. S. (2017). Prototypical networks for few-shot learning. In NeurIPS.

Stepanov, I., Shtopko, M., et al. (2025). GLiClass: Generalist lightweight model for sequence classification tasks. arXiv:2508.07662.

Tunstall, L. et al. (2022). Efficient few-shot learning without prompts. arXiv:2209.11055.

Wang, L. et al. (2024). Multilingual E5 text embeddings: A technical report. arXiv:2402.05672.

Yin, W., Hay, J., and Roth, D. (2019). Benchmarking zero-shot text classification: Datasets, evaluation and entailment approach. In EMNLP-IJCNLP.

Zaratiana, U. et al. (2024). GLiNER: Generalist model for named entity recognition using bidirectional transformer. In NAACL.

Zhang, Y. et al. (2025). Qwen3 Embedding: Advancing text embedding and reranking through foundation models. arXiv:2506.05176.

Zhao, Z. et al. (2021). Calibrate before use: Improving few-shot performance of language models. In ICML.