Attack Classification Using Retrieval-Augmented Generation and Large Language Models

The exponential rise in security alerts across modern information systems presents a critical challenge for cybersecurity operations, frequently overwhelming analysts and hindering timely incident response. To address this, we propose an automated threat classification framework that leverages RetrievalAugmented Generation (RAG) in combination with Large Language Models (LLMs) to accurately interpret and categorize attack types. By combining real-time data ingestion with contextual retrieval and advanced natural language understanding, the system efficiently interprets alert data and categorizes threats to support incident response and decision-making. Experimental evaluations show that the proposed approach achieves a classification accuracy of 94%, demonstrating strong promise for realworld deployment in security operations centers. These results highlight the potential of integrating RAG-LLM based frameworks to significantly enhance the scalability and effectiveness of cybersecurity defenses.