Transforming Alteon Support with AI-Powered Support-File Analysis - Part 2


Implementation Insights

Multi-Stage Preprocessing Engine

A crucial part of our system is the hierarchical domain‑aware preprocessing pipeline that transforms raw TSDMP data into enriched, analyzable components, ready to be fed to the LLM. It is a key part of the implementation to aid in overcoming the three aforementioned challenges. The multi-stage preprocessing schema identifies each semantic block of the TSDMP, adds to it relevant metadata, smooths out chaotic context, and makes it ready to be sent to the LLM, one homogeneous slice at a time. This enables targeted analysis where each section gets processed with its domain-specific expertise, while keeping the context window lean, preserving topical coherence, and allowing us to steer the model with precision, section by section of TSDMP. At a high level, our multi-stage preprocessing comprises of the parser, ablation engine and the context enrichment engine described below:

1. Custom TSDMP Parser

As noted earlier, the TSDMP file consists of heterogeneous data. In addition, the data is saved in various formats and tabular structures. This required a purpose-built parser from scratch that understands Alteon TSDMP specific data, file structures, and is also format aware of the different sections and semantic boundaries. Our parser performs intelligent chunking based on those semantic boundaries and saves the partitions (chunks) in structured storage, which can be easily accessed as key value pairs further down the pipeline.

2. Ablation Engine

Removes noise while preserving relevant diagnostic information in the TSDMP. This includes:

  1. a) Granular intelligent filtering at the level of partitions to detect and remove parts of a section that may carry distractors and induce chaotic contexts, eliciting LLM poor performance.
  2. b) Data within a section or entire sections that can be ignored owing to incomplete data , disabled subsystems/ modules and other heuristics indicating normal use. Also, the removal of redundant data within or across sections of the partitioned TSDMP. All of this keeps with our goal of efficient LLM usage and cost.

3. Context Enrichment

For reliable and enterprise grade RAG solutions, context enrichment is key and makes data significantly more amenable to LLM reasoning and analysis. After semantic partitioning and ablation , we transform each partition of unstructured or semi-structured TSDMP data into a more digestible, model-friendly format by adding metadata, clarifying ambiguous content, normalizing structure, and injecting domain-specific annotations and examples. This not only improves the LLM’s ability to understand the TSDMP data but also primes it with the right framing to guide token prediction, improve relevance, and reduce hallucinations. Our enrichment includes granular per partition decisions on creating section summaries, key metrics extraction and highlighting, annotation of technical terms, and contextual descriptions. For tables, our enrichment engine performs tabular data enhancement including conversion to clean markdown tables, standardizing timestamps and numeric representations, and adding contextual description of table columns, data type and its content.

Routing Layer

Owing to the heterogeneous nature of the TSDMP , there is a variance in complexity and structure across different semantic partitions, and a one-size-fits-all LLM approach would be prohibitively expensive and computationally wasteful. The routing layer was thus designed to balance latency, and cost-efficiency across the diverse segments of the TSDMP file, thereby optimizing cost of LLM usage and reducing processing time. We designed this to operate on a routing strategy that assigns the right level of LLM and prompt engineering to each partitioned section of the TSDMP. By doing so, we consistently maintain sub-$0.35 processing cost per TSDMP, regardless of TSDMP file size, while also reducing total analysis time.

Figure 2: TSDMP Routing Layer

Augment & Generation Schema

Here is a general outline of how we used partition-aware knowledge engineering, focused context construction, and explainable generation techniques to deliver transparent, reliable and high-precision outputs for each segment of the TSDMP file.

1. Knowledge Engineering

  1. a) Relationship Mappings: Here we worked with Alteo experts to draw out cross-section dependencies where issues in one area affect others, temporal relationships between events across different sections, relationship structures in configuration and diagnostic data.
  2. b) Baseline Establishment: Domain experts maintain mental models of "normal" system behavior. We worked with Alteon experts to codify this with statistical baselines for hundreds of counters/statistics, threshold definitions that trigger investigation, and pattern libraries of known issue signatures.
  3. c) Process Codification: Expert diagnostic reasoning follows established patterns that we captured in terms of triage workflows for prioritizing multiple potential issues, investigation sequences that efficiently narrow down root causes, and validation procedures for confirming diagnoses.

2. Guided In-Context Learning Architecture

Thanks to semantic partitioning into homogeneous topical chunks, we could now use in-context learning techniques to add detailed instructions and guides for section specific processing and analysis.

In general, the context pattern that we used is as follows:

[Technical Data Segment] + [Partition-Specific Analysis Guide] → [Focused Generation]

The upshot of how this works:

  1. a) Knowledge injection guides: The instructive guides are stored as configuration files.
  2. b) Context pairing: That matches TSDMP data partitions with relevant expert guidance.
  3. c) Partition awareness: Each TSDMP section is guided with specialized analysis instructions meant only for that section of the TSDMP.

All of this ensures the LLM receives focused, and coherent data segments. It enabled targeted and partition level expertise to steer the model with applicable domain knowledge for different sections. This prevented information overload that would typically degrade generation quality and limited context to manageable, related information

3. Advanced Generation Techniques

Technical support files often present chaotic contexts where relevant information might be embedded deep within or scattered in between irrelevant data or noise. We used a combination of Chain of Thought (CoT) (Wei et al. 2023), Chain of Note (CoN) (Yu et al. 2024) , Thread of thought (ThoT) (Zhou et al. 2023) and reasoning strategies to get maximal model performance and minimize confabulation and hallucinations.

Figure 3: LLM Steering Process Flow for TSDMP Analysis

4. Explainable Reasoning Paths

In mission-critical technical domains, the ability to trace, validate, debug and correct AI-driven analytical decisions is paramount. This necessitates the implementation of observability frameworks that provide transparency into the analytical process. We implemented reasoning tracing which not only improves performance but also provides transparent decision processes of the LLM that can be audited and improved quickly. These include traceable logic chains from observation to conclusion, confidence indicators based on knowledge certainty and data quality. This was pivotal in improving our instructions and guides to the model as well as informing the types of enrichments that were needed for different sections of the TSDMP to get the best performance out of the LLMs

Impact and Results

The transformation from a resource-intensive, expertise-dependent process into an AI-powered automated workflow has delivered measurable improvements in support operations. Support engineers can now obtain expert-level insights immediately, enabling faster escalation decisions and more targeted troubleshooting approaches. During early preview with support teams, we observed dramatic efficiency gains that validate this approach:

  • At minimum, a 5x increase observed in analysis efficiency on support cases requiring TSDMP analysis.
  • Up to 50x reduction in Mean Time To Detection (MTTD) in some cases.
  • Consistent sub-10-minute analysis time regardless of TSDMP file size.

Lessons Learned

  1. In-Context domain expertise: A well-structured guidance system delivered through in-context learning can achieve domain expertise without expensive fine-tuning, while maintaining flexibility to update and improve guidance dynamically.
  2. Routing intelligence is critical: Smart routing based on complexity analysis can dramatically reduce costs while maintaining quality.
  3. Observability is non-negotiable: Comprehensive logging and tracing are essential for debugging and improving domain-specific AI systems.
  4. Chunking strategy can make or break performance: Generic chunking strategies may fail on technical documents. In our case domain-aware segmentation was crucial.

The techniques we employed for TSDMP analysis should be applicable to other technical document analysis as well. For teams building similar domain-specific RAG systems, it is important to remember that the magic isn't just in the LLM - it's in the entire pipeline that transforms raw domain data into actionable intelligence before the LLM even comes into play.

References

Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J. D., Dhariwal, P., ... & Amodei, D. (2020). Language models are few-shot learners. Advances in neural information processing systems, 33, 1877-1901.

Wei, J., Wang, X., Schuurmans, D., Bosma, M., Xia, F., Chi, E., ... & Zhou, D. (2022). Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35, 24824-24837.

Yu, W., Zhang, H., Pan, X., Ma, K., Wang, H., & Yu, D. (2023). Chain-of-note: Enhancing robustness in retrieval-augmented language models. arXiv preprint arXiv:2311.09210.

Zhou, Y., Geng, X., Shen, T., Tao, C., Long, G., Lou, J. G., & Shen, J. (2023). Thread of thought unraveling chaotic contexts. arXiv preprint arXiv:2311.08734.

Zhao, P., Zhang, H., Yu, Q., Wang, Z., Geng, Y., Fu, F., ... & Cui, B. Retrieval-augmented generation for ai-generated content: A survey. arXiv 2024. arXiv preprint arXiv:2402.19473.

Arnab Chatterjee

Arnab Chatterjee

Arnab Chatterjee is a Principal Tier 4 Engineer at Radware with over 15 years of experience in network engineering and application security. He has served as Radware’s top-level escalation point for critical issues, leading complex engineering initiatives and driving innovative solutions. Arnab holds a Master’s degree in Electrical Engineering from the New Jersey Institute of Technology and a Master’s degree in Philosophy from the University of Edinburgh.

Contact Radware Sales

Our experts will answer your questions, assess your needs, and help you understand which products are best for your business.

Already a Customer?

We’re ready to help, whether you need support, additional services, or answers to your questions about our products and solutions.

Locations
Get Answers Now from KnowledgeBase
Get Free Online Product Training
Engage with Radware Technical Support
Join the Radware Customer Program

Get Social

Connect with experts and join the conversation about Radware technologies.

Blog
Security Research Center
CyberPedia