@article{ART003364219},
author={Jihun Jang and Jungpyo Hong},
title={A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification},
journal={Journal of The Korea Society of Computer and Information},
issn={1598-849X},
year={2026},
volume={31},
number={7},
pages={117-126}
TY - JOUR
AU - Jihun Jang
AU - Jungpyo Hong
TI - A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification
JO - Journal of The Korea Society of Computer and Information
PY - 2026
VL - 31
IS - 7
PB - The Korean Society Of Computer And Information
SP - 117
EP - 126
SN - 1598-849X
AB - Traditional Security Information and Event Management and Security Orchestration, Automation, and Response systems are widely used to detect cyber threats. However, rule-based detection methods have difficulty identifying complex attacks that require contextual understanding. This study proposes a two-stage threat scenario matching system that combines vector embedding and Large Language Model analysis. First, the system retrieves the Top-K most similar threat scenarios using embedding-based similarity search. Then, the LLM compares the candidate scenarios with the input security alerts and selects the best match. Experimental results using simulated breach data demonstrated that the detection accuracy, which was 91.54% in the embedding stage, was significantly enhanced through the LLM’s contextual re-verification, successfully identifying all threat scenarios with zero misclassifications.
KW - Security Automation;Alert Sequence Analysis;Security Threat Detection;Vector Embedding;LLM
DO -
UR -
ER -
Jihun Jang and Jungpyo Hong. (2026). A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification. Journal of The Korea Society of Computer and Information, 31(7), 117-126.
Jihun Jang and Jungpyo Hong. 2026, "A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification", Journal of The Korea Society of Computer and Information, vol.31, no.7 pp.117-126.
Jihun Jang, Jungpyo Hong "A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification" Journal of The Korea Society of Computer and Information 31.7 pp.117-126 (2026) : 117.
Jihun Jang, Jungpyo Hong. A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification. 2026; 31(7), 117-126.
Jihun Jang and Jungpyo Hong. "A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification" Journal of The Korea Society of Computer and Information 31, no.7 (2026) : 117-126.
Jihun Jang; Jungpyo Hong. A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification. Journal of The Korea Society of Computer and Information, 31(7), 117-126.
Jihun Jang; Jungpyo Hong. A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification. Journal of The Korea Society of Computer and Information. 2026; 31(7) 117-126.
Jihun Jang, Jungpyo Hong. A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification. 2026; 31(7), 117-126.
Jihun Jang and Jungpyo Hong. "A Two-Stage Framework for Cybersecurity Scenario Matching Using Embedding-Based Top-K Filtering and LLM Contextual Verification" Journal of The Korea Society of Computer and Information 31, no.7 (2026) : 117-126.
