CyberRAG: An Agentic RAG cyber attack classification and reporting tool
Francesco Blefari, Cristian Cosentino, Francesco Aurelio Pironti, Angelo Furfaro, Fabrizio Marozzo

TL;DR
CyberRAG is a modular, agent-based RAG framework that enhances cyber-attack classification, explanation, and reporting by combining specialized classifiers, iterative retrieval, and adaptive reasoning, significantly improving accuracy and interpretability.
Contribution
It introduces an agentic RAG architecture for cyber-attack detection that dynamically refines threat labels and explanations without retraining core components.
Findings
Achieved over 94% accuracy on attack classification tasks.
Generated explanations with high semantic similarity and expert-rated quality.
Maintained robustness against adversarial and unseen payloads.
Abstract
Intrusion Detection and Prevention Systems (IDS/IPS) in large enterprises can generate hundreds of thousands of alerts per hour, overwhelming analysts with logs requiring rapidly evolving expertise. Conventional machine-learning detectors reduce alert volume but still yield many false positives, while standard Retrieval-Augmented Generation (RAG) pipelines often retrieve irrelevant context and fail to justify predictions. We present CyberRAG, a modular agent-based RAG framework that delivers real-time classification, explanation, and structured reporting for cyber-attacks. A central LLM agent orchestrates: (i) fine-tuned classifiers specialized by attack family; (ii) tool adapters for enrichment and alerting; and (iii) an iterative retrieval-and-reason loop that queries a domain-specific knowledge base until evidence is relevant and self-consistent. Unlike traditional RAG, CyberRAG…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
MethodsLinear Warmup With Linear Decay · Refunds@Expedia|||How do I get a full refund from Expedia? · Attention Dropout · Byte Pair Encoding · Dense Connections · Softmax · Layer Normalization · Dropout · BERT · BART
