{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T08:07:57Z","timestamp":1783930077722,"version":"3.55.0"},"reference-count":50,"publisher":"Institution of Engineering and Technology (IET)","issue":"3","license":[{"start":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T00:00:00Z","timestamp":1777852800000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/creativecommons.org\/licenses\/by-nc-nd\/4.0\/"},{"start":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T00:00:00Z","timestamp":1777852800000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["ietresearch.onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["CAAI Trans on Intel Tech"],"published-print":{"date-parts":[[2026,6]]},"abstract":"<jats:title>ABSTRACT<\/jats:title>\n                  <jats:p>Security operations centre (SOC) analysts must investigate alerts, correlate threat intelligence and interpret heterogeneous telemetry under tight timing constraints. Although large language models (LLMs) offer strong understanding capabilities, directly applying them to SOC environments remains challenging due to semantic ambiguity in analyst queries, fragmented multisource event data, limited domain\u2010specific reasoning and reliability concerns associated with unconstrained query generation. We present a task\u2010driven knowledge\u2010augmented framework designed to produce verifiable and contextually grounded responses for SOC workflows. The framework integrates four components: (i) contrastive context task recognition that mitigates semantic ambiguity by mapping analyst queries to predefined SOC task types; (ii) expert\u2010guided knowledge augmentation that fuses dense and sparse retrieval to bridge the semantic gap; (iii) schema\u2010aligned event retrieval combined with entity\u2010centric evidence profiling to ensure reliable and secure access to heterogeneous telemetry and (iv) verifiable task\u2010aware generation that constrains model outputs to retrieved knowledge and security events. To assess the framework, we construct a benchmark of 12,500 validated question\u2013answer pairs derived through semiautomated synthesis over more than 34 million real SOC records. Experiments across multiple foundation models demonstrate consistent improvements in relevance and grounding quality. Our results indicate that the four proposed components substantially enhance LLMs' reliability in practical SOC analysis.<\/jats:p>","DOI":"10.1049\/cit2.70138","type":"journal-article","created":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T18:47:33Z","timestamp":1777920453000},"page":"646-666","update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["From Ambiguous Queries to Verifiable Insights: A Task\u2010Driven Framework for LLM\u2010Powered SOC Analysis\n                    <sup>\u22c6<\/sup>"],"prefix":"10.1049","volume":"11","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-7346-1850","authenticated-orcid":false,"given":"Huan","family":"Zhang","sequence":"first","affiliation":[{"name":"Harbin Institute of Technology (Shenzhen)  Shenzhen China"},{"name":"Department of New Networks Pengcheng Laboratory  Shenzhen China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-5702-9897","authenticated-orcid":false,"given":"Haiyan","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of New Networks Pengcheng Laboratory  Shenzhen China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1153-2726","authenticated-orcid":false,"given":"Hao","family":"Tan","sequence":"additional","affiliation":[{"name":"Harbin Institute of Technology (Shenzhen)  Shenzhen China"},{"name":"Department of New Networks Pengcheng Laboratory  Shenzhen China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0009-1627-5811","authenticated-orcid":false,"given":"Liyi","family":"Zeng","sequence":"additional","affiliation":[{"name":"Department of New Networks Pengcheng Laboratory  Shenzhen China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jingnan","family":"Li","sequence":"additional","affiliation":[{"name":"Bank of China  Beijing China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-7546-852X","authenticated-orcid":false,"given":"Zhaoquan","family":"Gu","sequence":"additional","affiliation":[{"name":"Harbin Institute of Technology (Shenzhen)  Shenzhen China"},{"name":"Department of New Networks Pengcheng Laboratory  Shenzhen China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"265","published-online":{"date-parts":[[2026,5,4]]},"reference":[{"key":"e_1_2_11_2_1","doi-asserted-by":"publisher","DOI":"10.1145\/3672608.3707898"},{"key":"e_1_2_11_3_1","first-page":"238","volume-title":"European Symposium on Research in Computer Security","author":"Rajapaksha S.","year":"2024"},{"key":"e_1_2_11_4_1","doi-asserted-by":"crossref","unstructured":"C.Zhao G.Agrawal T.Kumarage et\u00a0al. \u201cOntology\u2010Aware Rag for Improved Question\u2010Answering in Cybersecurity Education \u201d preprint arXiv:2412.14191 (2024).","DOI":"10.1109\/BigData66926.2025.11401740"},{"key":"e_1_2_11_5_1","doi-asserted-by":"publisher","DOI":"10.14778\/3685800.3685905"},{"key":"e_1_2_11_6_1","doi-asserted-by":"publisher","DOI":"10.1007\/s41019\u2010023\u201000235\u20106"},{"key":"e_1_2_11_7_1","first-page":"540","volume-title":"Proceedings of the 31st International Conference on Computational Linguistics","author":"Wang B.","year":"2025"},{"key":"e_1_2_11_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3654930"},{"key":"e_1_2_11_9_1","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1577"},{"key":"e_1_2_11_10_1","doi-asserted-by":"publisher","DOI":"10.14778\/3641204.3641221"},{"key":"e_1_2_11_11_1","doi-asserted-by":"publisher","DOI":"10.1109\/tcss.2023.3293331"},{"key":"e_1_2_11_12_1","doi-asserted-by":"publisher","DOI":"10.1109\/tfuzz.2024.3443207"},{"key":"e_1_2_11_13_1","doi-asserted-by":"publisher","DOI":"10.3390\/computers14020067"},{"key":"e_1_2_11_14_1","doi-asserted-by":"publisher","DOI":"10.3390\/s25030870"},{"key":"e_1_2_11_15_1","doi-asserted-by":"publisher","DOI":"10.1186\/s42400\u2010025\u201000361\u2010w"},{"key":"e_1_2_11_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACSACW65225.2024.00036"},{"key":"e_1_2_11_17_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2025.241357"},{"key":"e_1_2_11_18_1","doi-asserted-by":"publisher","DOI":"10.7717\/peerj\u2010cs.3371"},{"key":"e_1_2_11_19_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2025.108186"},{"key":"e_1_2_11_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2025.3609486"},{"key":"e_1_2_11_21_1","unstructured":"S.Talaei M.Pourreza Y.\u2010C.Chang A.Mirhoseini andA.Saberi \u201cChess: Contextual Harnessing for Efficient Sql Synthesis \u201d preprint arXiv:2405.16755 (2024)."},{"key":"e_1_2_11_22_1","volume-title":"The Thirteenth International Conference on Learning Representations, ICLR 2025, Singapore","author":"Pourreza M.","year":"2025"},{"key":"e_1_2_11_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/I2CT51068.2021.9418136"},{"key":"e_1_2_11_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICCP60212.2023.10398612"},{"key":"e_1_2_11_25_1","doi-asserted-by":"publisher","DOI":"10.1109\/BigData52589.2021.9671956"},{"key":"e_1_2_11_26_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.future.2024.01.032"},{"key":"e_1_2_11_27_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2022.102789"},{"key":"e_1_2_11_28_1","doi-asserted-by":"publisher","DOI":"10.1145\/3512768"},{"key":"e_1_2_11_29_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER56733.2023.00057"},{"key":"e_1_2_11_30_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jnca.2022.103370"},{"key":"e_1_2_11_31_1","first-page":"191","volume-title":"Companion Proceedings of the ACM on Web Conference","author":"Freitas S.","year":"2025"},{"key":"e_1_2_11_32_1","unstructured":"P.Tseng Z.Yeh X.Dai andP.Liu \u201cUsing Llms to Automate Threat Intelligence Analysis Workflows in Security Operation Centers \u201d preprint arXiv:2407.13093 (2024)."},{"key":"e_1_2_11_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2024.103999"},{"key":"e_1_2_11_34_1","first-page":"39818","volume-title":"International Conference on Machine Learning","author":"Ye J.","year":"2023"},{"key":"e_1_2_11_35_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.emnlp-main.741"},{"key":"e_1_2_11_36_1","doi-asserted-by":"publisher","DOI":"10.52202\/079017\u20102567"},{"key":"e_1_2_11_37_1","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1607"},{"key":"e_1_2_11_38_1","unstructured":"P.Jing M.Tang X.Shi et\u00a0al. \u201cSecbench: A Comprehensive Multi\u2010Dimensional Benchmarking Dataset for Llms in Cybersecurity \u201d preprint arXiv:2412.20787 (2024)."},{"key":"e_1_2_11_39_1","unstructured":"G. C.Mandiant \u201cM\u2010Trends 2024: Special Report \u201d (2024) https:\/\/services.google.com\/fh\/files\/misc\/m\u2010trends\u20102024\u2010executive\u2010edition.pdf."},{"key":"e_1_2_11_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSR57506.2023.10224937"},{"key":"e_1_2_11_41_1","unstructured":"A.Liu B.Feng B.Xue et\u00a0al. \u201cDeepseek\u2010v3 Technical Report \u201d preprint arXiv:2412 (2024):19437."},{"key":"e_1_2_11_42_1","unstructured":"J.Achiam S.Adler S.Agarwal et\u00a0al. \u201cGpt\u20104 Technical Report \u201d preprint arXiv:2303.08774 (2023)."},{"key":"e_1_2_11_43_1","unstructured":"A.Grattafiori A.Dubey A.Jauhri et\u00a0al. \u201cThe Llama 3 Herd of Models \u201d preprint arXiv:2407.21783 (2024)."},{"key":"e_1_2_11_44_1","unstructured":"B.Hui J.Yang Z.Cui et\u00a0al. \u201cQwen2.5\u2010Coder Technical Report \u201d preprint arXiv:2409.12186 (2024)."},{"key":"e_1_2_11_45_1","unstructured":"Y.\u2010C.Yu T.\u2010H.Chiang C.\u2010W.Tsai C.\u2010M.Huang andW.\u2010K.Tsao \u201cPrimus: A Pioneering Collection of Open\u2010Source Datasets for Cybersecurity Llm Training \u201d preprint arXiv:2502.11191 (2025)."},{"key":"e_1_2_11_46_1","unstructured":"S.Clouditera \u201cA Network Security Large Language Model \u201d (2023) https:\/\/github.com\/Clouditera\/secgpt."},{"key":"e_1_2_11_47_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.eacl-demo.16"},{"key":"e_1_2_11_48_1","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2020"},{"key":"e_1_2_11_49_1","doi-asserted-by":"publisher","DOI":"10.1145\/3626772.3657878"},{"key":"e_1_2_11_50_1","unstructured":"L.Wang N.Yang X.Huang et\u00a0al. \u201cText Embeddings by Weakly\u2010Supervised Contrastive Pre\u2010Training \u201d preprint arXiv:2212.03533 (2022)."},{"key":"e_1_2_11_51_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.dib.2024.110290"}],"container-title":["CAAI Transactions on Intelligence Technology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/ietresearch.onlinelibrary.wiley.com\/doi\/pdf\/10.1049\/cit2.70138","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ietresearch.onlinelibrary.wiley.com\/doi\/full-xml\/10.1049\/cit2.70138","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/ietresearch.onlinelibrary.wiley.com\/doi\/pdf\/10.1049\/cit2.70138","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,13]],"date-time":"2026-07-13T07:24:40Z","timestamp":1783927480000},"score":1,"resource":{"primary":{"URL":"https:\/\/ietresearch.onlinelibrary.wiley.com\/doi\/10.1049\/cit2.70138"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,4]]},"references-count":50,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,6]]}},"alternative-id":["10.1049\/cit2.70138"],"URL":"https:\/\/doi.org\/10.1049\/cit2.70138","archive":["Portico"],"relation":{},"ISSN":["2468-6557","2468-2322"],"issn-type":[{"value":"2468-6557","type":"print"},{"value":"2468-2322","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,4]]},"assertion":[{"value":"2025-12-03","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-04-02","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-04","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}