In this paper, we introduce MoRSE (Mixture of RAGs Security Experts), the first specialised AI chatbot for cybersecurity. MoRSE aims to provide comprehensive and complete knowledge about cybersecurity. MoRSE uses two RAG (Retrieval Augmented Generation) systems designed to retrieve and organize information from multidimensional cybersecurity contexts. MoRSE differs from traditional RAGs by using parallel retrievers that work together to retrieve semantically related information in different formats and structures. Unlike traditional Large Language Models (LLMs) that rely on Parametric Knowledge Bases, MoRSE retrieves relevant documents from Non-Parametric Knowledge Bases in response to user queries. Subsequently, MoRSE uses this information to generate accurate answers. In addition, MoRSE benefits from real-time updates to its knowledge bases, enabling continuous knowledge enrichment without retraining. We have evaluated the effectiveness of MoRSE against other state-of-the-art LLMs, evaluating the system on 600 cybersecurity specific questions. The experimental evaluation has shown that the improvement in terms of relevance and correctness of the answer is more than 10% compared to known solutions such as GPT-4 and Mixtral 7x8.

MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation / Simoni, M., Saracino, A., P, V., Conti, M.. - (2025), pp. 1213-1222. (ACM/SIGAPP Symposium on Applied Computing Catania; Italy ) [10.1145/3672608.3707898].

MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation

Simoni, Marco
Primo
;
2025

Abstract

In this paper, we introduce MoRSE (Mixture of RAGs Security Experts), the first specialised AI chatbot for cybersecurity. MoRSE aims to provide comprehensive and complete knowledge about cybersecurity. MoRSE uses two RAG (Retrieval Augmented Generation) systems designed to retrieve and organize information from multidimensional cybersecurity contexts. MoRSE differs from traditional RAGs by using parallel retrievers that work together to retrieve semantically related information in different formats and structures. Unlike traditional Large Language Models (LLMs) that rely on Parametric Knowledge Bases, MoRSE retrieves relevant documents from Non-Parametric Knowledge Bases in response to user queries. Subsequently, MoRSE uses this information to generate accurate answers. In addition, MoRSE benefits from real-time updates to its knowledge bases, enabling continuous knowledge enrichment without retraining. We have evaluated the effectiveness of MoRSE against other state-of-the-art LLMs, evaluating the system on 600 cybersecurity specific questions. The experimental evaluation has shown that the improvement in terms of relevance and correctness of the answer is more than 10% compared to known solutions such as GPT-4 and Mixtral 7x8.
2025
ACM/SIGAPP Symposium on Applied Computing
cyber threat intelligence; cybersecurity; large language model; retrieval augmented generation
04 Pubblicazione in atti di convegno::04b Atto di convegno in volume
MoRSE: Bridging the Gap in Cybersecurity Expertise with Retrieval Augmented Generation / Simoni, M., Saracino, A., P, V., Conti, M.. - (2025), pp. 1213-1222. (ACM/SIGAPP Symposium on Applied Computing Catania; Italy ) [10.1145/3672608.3707898].
File allegati a questo prodotto
File Dimensione Formato  
Simoni_MoRSE_2025.pdf

solo gestori archivio

Note: https://doi.org/10.1145/3672608.3707898
Tipologia: Versione editoriale (versione pubblicata con il layout dell'editore)
Licenza: Creative commons
Dimensione 1.63 MB
Formato Adobe PDF
1.63 MB Adobe PDF   Contatta l'autore

I documenti in IRIS sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.

Utilizza questo identificativo per citare o creare un link a questo documento: https://hdl.handle.net/11573/1752435
Citazioni
  • ???jsp.display-item.citation.pmc??? ND
  • Scopus 4
  • ???jsp.display-item.citation.isi??? 3
social impact