Machine-learning-based Intrusion Detection Systems (IDS) have achieved impressive accuracy in classifying network attacks, yet they consistently fall short on the question that matters most to a security analyst: what should I do next? This paper presents a unified, end-to-end framework that closes the gap between threat detection and actionable response. The system operates in two tightly coupled stages. First, an ensemble of three independently trained binary Deep Neural Networks (DNNs) classifies network traffic flows as Benign, Denial of Service (DoS), or Distributed Denial of Service (DDoS), achieving 99.84% accuracy on the CICIDS2018 dataset and 95.30% on the UNSW-NB15 dataset. Second, a Retrieval-Augmented Generation (RAG) pipeline constructs explanation-aware prompts from the top-5 anomalous features, retrieves the most semantically and lexically relevant guidance from a knowledge base derived from authorized sources and di- rects a locally deployed language model to synthesise structured, citation-grounded mitigation reports. The RAG-enhanced reports outperform vanilla LLM outputs across all automated evaluation metrics.

翻译：基于机器学习的入侵检测系统（IDS）在网络攻击分类中已实现惊人的准确率，但在安全分析师最关心的问题——"下一步该怎么做？"——上始终存在不足。本文提出统一的端到端框架，弥合威胁检测与可操作响应之间的鸿沟。该系统通过两个紧密耦合阶段协同运作：第一阶段，由三个独立训练的二元深度神经网络（DNN）组成的集成模型将网络流量分类为良性、拒绝服务（DoS）或分布式拒绝服务（DDoS），在CICIDS2018数据集上达到99.84%的准确率，在UNSW-NB15数据集上达到95.30%；第二阶段，检索增强生成（RAG）流水线从前5个异常特征构建基于解释的提示，从经授权来源的知识库中检索语义和词汇相关性最强的指导方案，并引导本地部署的语言模型综合生成结构化、带有引证的缓解报告。在所有自动化评估指标上，经RAG增强的报告均优于原始LLM输出。