RAG-NIDS+: Temporally Aware Retrieval-Augmented Network Intrusion Detection and Response
Main Article Content
Abstract
Network intrusion detection systems should not only detect anomalous traffic but also provide relevant evidence and actionable response guidance. This paper presents RAG-NIDS+, an end-to-end framework integrating enhanced anomaly detection, temporally aware threat-intelligence retrieval, and evidence-grounded recommendation generation. A temporally attentive LSTM autoencoder combines attention-weighted sequence representation, dynamics-aware reconstruction, and hybrid anomaly scoring to capture both sustained and short-lived anomalies. Hybrid lexical--semantic retrieval with time-decay weighting prioritizes relevant and recent threat intelligence, which is then combined with anomaly metadata and operational context to ground LLaMA-3-8B-Instruct. Experiments on UNSW-NB15, CICIDS2017, and TON-IoT achieved Macro-F1 scores of 0.894, 0.962, and 0.893, respectively. Temporal weighting improved Precision@10 from 0.848 to 0.910 and nDCG@10 from 0.862 to 0.920. Compared with the ungrounded language model, the full framework reduced hallucination from 28.4% to 3.2% and achieved an overall human score of 4.58 out of 5. On the evaluated A100-based server, RAG-NIDS+ achieved a P95 end-to-end latency of 425~ms, supporting analyst-facing intrusion analysis and response generation.
Keywords
Network Intrusion Detection System (NIDS), Retrieval-Augmented Generation (RAG), Threat Intelligence, Evidence-Grounded Recommendation Generation
Article Details
This work is licensed under a Creative Commons Attribution 4.0 International License.
References
[2] H. Nandanwar and R. Katarya, Deep learning enabled intrusion detection system for industrial IoT environment, Expert Systems with Applications, vol. 249, Sep. 2024, Art. no. 123080. https://doi.org/10.1016/j.eswa.2024.123808
[3] M. Umer, M. Tahir, M. Sardaraz, M. Sharif, H. Elmannai, and A. D. Algarni, Network intrusion detection model using wrapper based feature selection and multi head attention transformers, Scientific Reports, vol. 15, Aug. 2025, Art. no. 28718. https://doi.org/10.1038/s41598-025-11348-5
[4] Y. Gao, Y. Xiong, X. Gao, K. Jia, J. Pan, Y. Bi, Y. Dai, J. Sun, and H. Wang, Retrieval-augmented generation for large language models: A survey, arXiv preprint arXiv:2312.10997, Dec. 2023.
[5] S. Zhao, Y. Yang, Z. Wang, Z. He, L. K. Qiu, and L. Qiu, Retrieval augmented generation (RAG) and beyond: A comprehensive survey on how to make your LLMs use external data more wisely, arXiv preprint arXiv:2409.14924, Sep. 2024.
[6] X. Li, Z. Zheng, M. Zhao, Y. Zhao, L. Shi, and B. Wang, RLFE-IDS: A framework of intrusion detection system based on retrieval augmented generation and large language Model, Computer Networks, vol. 268, Aug. 2025, Art. no. 111341. https://doi.org/10.1016/j.comnet.2025.111341
[7] F. Blefari, C. Cosentino, F. A. Pironti, A. Furfaro, and F. Marozzo, CyberRAG: An agentic RAG cyber attack classification and reporting tool, Future Generation Computer Systems, vol. 176, Mar. 2026, Art. no. 108186. https://doi.org/10.1016/j.future.2025.108186
[8] R. Devendiran and A. V. Turukmane, Dugat-LSTM: Deep learning based network intrusion detection system using chaotic optimization strategy, Expert Systems with Applications, vol. 245, Jul. 2024, Art. no. 123027. https://doi.org/10.1016/j.eswa.2023.123027
[9] Z. Long, H. Yan, G. Shen, X. Zhang, H. He, and L. Cheng, A Transformer-based Network Intrusion Detection Approach for Cloud Security, Journal of Cloud Computing, vol. 13, no. 1, Jan. 2024, Art. no. 5. https://doi.org/10.1186/s13677-023-00574-9
[10] M. Sarhan, S. Layeghy, N. Moustafa, and M. Portmann, Cyber threat intelligence sharing scheme based on federated learning for network intrusion detection, Journal of Network and Systems Management, vol. 31, iss. 1, p. 3, Oct. 2022. https://doi.org/10.1007/s10922-022-09691-3
[11] M. Guarascio, N. Cassavia, F. S. Pisani, and G. Manco, Boosting cyber-threat intelligence via collaborative intrusion detection, Future Generation Computer Systems, vol. 135, pp. 30–43, 2022.
[12] A. Lekssays, U. Shukla, H. T. Sencar, and M. R. Parvez, TechniqueRAG: Retrieval Augmented Generation for Adversarial Technique Annotation in Cyber Threat Intelligence Text, pp. 20913–20926, Jul. 2025 . https://doi.org/10.18653/v1/2025.findings-acl.1076
[13] L. Breiman, Random forests, Machine Learning, vol. 45, no. 1, pp. 5–32, Oct. 2001. https://doi.org/10.1023/A:1010933404324
[14] M. Sakurada and T. Yairi, Anomaly Detection Using Autoencoders with Nonlinear Dimensionality Reduction, Dec. 2014.
https://doi.org/10.1145/2689746.2689747
[15] P. Malhotra, A. Ramakrishnan, G. Anand, L. Vig, P. Agarwal, and G. Shroff, LSTM-based Encoder-Decoder for Multi-sensor Anomaly Detection, Jul. 2016. https://doi.org/10.48550/arXiv.1607.00148
[16] S. Kiranyaz, O. Avci, O. Abdeljaber, T. Ince, M. Gabbouj, and D. J. Inman, 1D convolutional neural networks and applications: A survey, Mechanical Systems and Signal Processing, vol. 151, Apr. 2021, Art. no. 107398. https://doi.org/10.1016/j.ymssp.2020.107398