Context vs. Compute: Self-Hosted Detection Rule Generation with Knowledge-Graph-Augmented Language Models

Statut : accepté le 15 septembre 2026 avec présentation en poster à IEEE CloudCom 2026 (Paris, 29 octobre 2026) ; version finale et copyright déposés ; actes IEEE à paraître.

Contribution in brief

This work compares model capacity and structured context for generating SIEM detection rules. It contrasts no context, retrieval-augmented context, knowledge-graph context and their combination across open-weight models. The evaluation separates structural properties of generated rules from their effectiveness in detecting attacks.

The available submission used cloud inference infrastructure. Equivalence with local quantized deployment was assumed and had not yet been validated in that version. The camera-ready revision is in preparation, so numerical claims should be taken from the eventual final manuscript.

Publication status

The organizers offered proceedings publication with a poster on 15 September 2026. The final version and IEEE copyright were submitted on 29 September 2026. The DOI will be added once the proceedings are published.

Related work: LLM4Sec · ANUBIS.