On-Premise SLMs vs. Commercial LLMs: Prompt Engineering and Incident Classification in SOCs and CSIRTs
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866918208399736832 |
|---|---|
| author | Almeida, Gefté Pohlmann, Marcio Severo, Alex Kreutz, Diego Heinrich, Tiago Pereira, Lourenço |
| author_facet | Almeida, Gefté Pohlmann, Marcio Severo, Alex Kreutz, Diego Heinrich, Tiago Pereira, Lourenço |
| contents | In this study, we evaluate open-source models for security incident classification, comparing them with proprietary models. We utilize a dataset of anonymized real incidents, categorized according to the NIST SP 800-61r3 taxonomy and processed using five prompt-engineering techniques (PHP, SHP, HTP, PRP, and ZSL). The results indicate that, although proprietary models still exhibit higher accuracy, locally deployed open-source models provide advantages in privacy, cost-effectiveness, and data sovereignty. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2511_14908 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | On-Premise SLMs vs. Commercial LLMs: Prompt Engineering and Incident Classification in SOCs and CSIRTs Almeida, Gefté Pohlmann, Marcio Severo, Alex Kreutz, Diego Heinrich, Tiago Pereira, Lourenço Cryptography and Security Artificial Intelligence Machine Learning 68T01 I.2 In this study, we evaluate open-source models for security incident classification, comparing them with proprietary models. We utilize a dataset of anonymized real incidents, categorized according to the NIST SP 800-61r3 taxonomy and processed using five prompt-engineering techniques (PHP, SHP, HTP, PRP, and ZSL). The results indicate that, although proprietary models still exhibit higher accuracy, locally deployed open-source models provide advantages in privacy, cost-effectiveness, and data sovereignty. |
| title | On-Premise SLMs vs. Commercial LLMs: Prompt Engineering and Incident Classification in SOCs and CSIRTs |
| topic | Cryptography and Security Artificial Intelligence Machine Learning 68T01 I.2 |
| url | https://arxiv.org/abs/2511.14908 |