The construction method of cybersecurity large model based on RAG

To address the limitations of traditional cybersecurity technologies in responding to complex cyberattacks and the challenges faced by large language model (LLM) in cybersecurity applications (e.g., hallucinations, outdated knowledge bases, and insufficient interpretability), this paper proposes a construction method for a cybersecurity large model based on the Retrieval-Augmented Generation (RAG) architecture. Through three stages—functional analysis, architectural design, and technical implementation—this approach completes the "4-layer, 1-module" construction and practical deployment of the RAG system, bridging the gaps in applying generic LLM to cybersecurity domains. Furthermore, this study innovatively introduces mechanisms including parameter adaptive optimization, metadata-filtered retrieval,dynamic permission management and multi-round evaluation feedback to ensure the model’s usability, trustworthiness and security.