GRAL: A GNN-RAG-LLM Framework for Intelligent Cybersecurity Alert Correlation and Analysis

Abstract

In critical infrastructure environments, cybersecurity situation-awareness platforms generate large volumes of alerts, including substantial numbers of false positives, placing a considerable burden on security analysts. At present, alert correlation methods mainly rely on rule-based matching or statistical clustering, and large language models often lack the domain-specific threat intelligence required for reliable security analysis. This paper proposes GRAL, which is an AI-driven framework that combines graph neural networks (GNN) for cross-asset temporal alert correlation, retrieval-augmented generation (RAG) for dynamic threat intelligence enrichment, and large language models (LLM) for semantic reasoning and verdict generation. A temporal heterogeneous graph attention network constructs alert-relation graphs within a 72 h sliding window, and temporal decay and multi-relational dependencies are captured. Powered by bge-m3 embeddings and a dense vector index, the RAG module retrieves the most relevant threat intelligence entries above a cosine similarity threshold of 0.75. A domain-specific dataset of 1000 annotated security alerts from a nuclear power operational environment was built, and Cohen’s Kappa reached 0.87. The experiments show that GRAL achieves a macro-averaged precision of 87.0%, a macro-averaged recall of 97.0%, and a binary false-positive rate of 9.1%, together with 92.5% alert compression. Generalisation capability is confirmed by cross-dataset evaluation on CICIDS2017 (93.0% accuracy and 92.5% F1-score) and UNSW-NB15 (89.4% accuracy and 89.8% F1-score).