Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

ReGAIN: Retrieval-Grounded AI Framework for Network Traffic Analysis

Shaghayegh Shajarian, Kennedy Marsh, James Benson, Sajad Khorsandroo, Mahmoud Abdelsalam

TL;DR

ReGAIN tackles the lack of interpretable, evidence-grounded network traffic analysis by integrating a data-to-language summarization layer, a multi-collection vector knowledge base, retrieval-augmented reasoning, and LLM-driven analysis with explicit citations. It converts telemetry into natural-language summaries, indexes them semantically, and uses hierarchical retrieval with metadata filtering, MMR, and multi-stage reranking to ground LLM outputs in verifiable evidence, aided by an abstention gate to avoid hallucinations. Evaluation on MAWILab-derived ICMP ping flood and TCP SYN flood traces yields high accuracy (95.95–98.82%) and near-perfect recall (0.98–1.00) across ground-truth and expert labels, outperforming rule-based and ML baselines. The framework provides explainability through cited evidence and an interactive, human-in-the-loop workflow, enabling trustworthy, actionable network security analysis for forensic investigations and incident response. It demonstrates the practicality of retrieval-augmented, NL-grounded traffic analysis for modern networks.

Abstract

Modern networks generate vast, heterogeneous traffic that must be continuously analyzed for security and performance. Traditional network traffic analysis systems, whether rule-based or machine learning-driven, often suffer from high false positives and lack interpretability, limiting analyst trust. In this paper, we present ReGAIN, a multi-stage framework that combines traffic summarization, retrieval-augmented generation (RAG), and Large Language Model (LLM) reasoning for transparent and accurate network traffic analysis. ReGAIN creates natural-language summaries from network traffic, embeds them into a multi-collection vector database, and utilizes a hierarchical retrieval pipeline to ground LLM responses with evidence citations. The pipeline features metadata-based filtering, MMR sampling, a two-stage cross-encoder reranking mechanism, and an abstention mechanism to reduce hallucinations and ensure grounded reasoning. Evaluated on ICMP ping flood and TCP SYN flood traces from the real-world traffic dataset, it demonstrates robust performance, achieving accuracy between 95.95% and 98.82% across different attack types and evaluation benchmarks. These results are validated against two complementary sources: dataset ground truth and human expert assessments. ReGAIN also outperforms rule-based, classical ML, and deep learning baselines while providing unique explainability through trustworthy, verifiable responses.

ReGAIN: Retrieval-Grounded AI Framework for Network Traffic Analysis

TL;DR

ReGAIN tackles the lack of interpretable, evidence-grounded network traffic analysis by integrating a data-to-language summarization layer, a multi-collection vector knowledge base, retrieval-augmented reasoning, and LLM-driven analysis with explicit citations. It converts telemetry into natural-language summaries, indexes them semantically, and uses hierarchical retrieval with metadata filtering, MMR, and multi-stage reranking to ground LLM outputs in verifiable evidence, aided by an abstention gate to avoid hallucinations. Evaluation on MAWILab-derived ICMP ping flood and TCP SYN flood traces yields high accuracy (95.95–98.82%) and near-perfect recall (0.98–1.00) across ground-truth and expert labels, outperforming rule-based and ML baselines. The framework provides explainability through cited evidence and an interactive, human-in-the-loop workflow, enabling trustworthy, actionable network security analysis for forensic investigations and incident response. It demonstrates the practicality of retrieval-augmented, NL-grounded traffic analysis for modern networks.

Abstract

Modern networks generate vast, heterogeneous traffic that must be continuously analyzed for security and performance. Traditional network traffic analysis systems, whether rule-based or machine learning-driven, often suffer from high false positives and lack interpretability, limiting analyst trust. In this paper, we present ReGAIN, a multi-stage framework that combines traffic summarization, retrieval-augmented generation (RAG), and Large Language Model (LLM) reasoning for transparent and accurate network traffic analysis. ReGAIN creates natural-language summaries from network traffic, embeds them into a multi-collection vector database, and utilizes a hierarchical retrieval pipeline to ground LLM responses with evidence citations. The pipeline features metadata-based filtering, MMR sampling, a two-stage cross-encoder reranking mechanism, and an abstention mechanism to reduce hallucinations and ensure grounded reasoning. Evaluated on ICMP ping flood and TCP SYN flood traces from the real-world traffic dataset, it demonstrates robust performance, achieving accuracy between 95.95% and 98.82% across different attack types and evaluation benchmarks. These results are validated against two complementary sources: dataset ground truth and human expert assessments. ReGAIN also outperforms rule-based, classical ML, and deep learning baselines while providing unique explainability through trustworthy, verifiable responses.
Paper Structure (20 sections, 9 equations, 7 figures, 3 tables)

This paper contains 20 sections, 9 equations, 7 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. ReGAIN Framework
  4. Data Ingestion and Summarization
  5. Semantic Vectorization and Knowledge Base Builder
  6. Retrieval-Augmented Reasoning and Generation
  7. Human-in-the-Loop Interaction
  8. Experimental Setup
  9. Dataset and Knowledge Base
  10. Prompt Structure
  11. Inference Parameters
  12. Evaluation
  13. SYN Flood Attack
  14. Results Against Ground Truth
  15. Results Against Expert Labels
  16. ...and 5 more sections

Figures (7)

  • Figure 1: ReGAIN architecture: pipeline from traffic ingestion to reasoning.
  • Figure 2: An abridged prompt and output of the system.
  • Figure 3: SYN Flood Evaluation Against Ground Truth: (a) Confusion matrix, (b) ROC curve.
  • Figure 4: SYN Flood Evaluation Against Expert Labels: (a) Confusion matrix, (b) ROC curve.
  • Figure 5: Ping Flood Evaluation Against Ground Truth: (a) Confusion matrix, (b) ROC curve.
  • ...and 2 more figures