Context vs. Compute: Self-Hosted Detection Rule Generation with Knowledge-Graph-Augmented Language Models
Accepted for IEEE CloudCom 2026 proceedings with a poster presentation opportunity, subject to registration and camera-ready requirements. Proceedings publication and DOI are not yet verified. IEEE CloudCom 2026
Tristan Madani; Yulliwas Ameur; Samia Bouzefrane. "Context vs. Compute: Self-Hosted Detection Rule Generation with Knowledge-Graph-Augmented Language Models." IEEE CloudCom 2026. Proceedings forthcoming, subject to final publication requirements.
Status: Accepted for IEEE CloudCom 2026 proceedings with a poster presentation opportunity, subject to registration and camera-ready requirements. Proceedings publication and DOI are not yet verified.
Contribution in brief
This work compares model capacity and structured context for generating SIEM detection rules. It contrasts no context, retrieval-augmented context, knowledge-graph context and their combination across open-weight models. The evaluation separates structural properties of generated rules from their effectiveness in detecting attacks.
The available submission used cloud inference infrastructure. Equivalence with local quantized deployment was assumed and had not yet been validated in that version. The camera-ready revision is in preparation, so numerical claims should be taken from the eventual final manuscript.
Publication status
The organizers offered proceedings publication with a poster on 15 September 2026. Final publication remains subject to author registration and the conference’s camera-ready requirements. This record does not claim a regular oral presentation, a completed proceedings deposit or an assigned DOI. The page date is the date this record was added.