Optimizing Local LLM Deployment for 5G CVE Classification Avoiding External Data Exposure

The deployment of 5G networks and increasing virtualization of network components have expanded the attack surface of telecommunications infrastructures, requiring domain specific expertise for effective and rapid vulnerability detection and assessment. AI-based solutions could be a valid support, but any information regarding 5G configurations or infrastructure architectures is highly sensitive and often subject to data protection policy that prohibit sharing with external services, including Large Language Models (LLMs) hosted in proprietary cloud systems. On the other hand, a local LLM deployment ensures compliance with confidentiality requirements while maintaining control over critical information. Our research investigates the capabilities of LLMs, from lightweight to frontier architectures, for identifying 5G relevant Common Vulnerabilities and Exposures (CVEs), by introducing a framework that executes a multi-model evaluation with progressive prompt complexity. We validate LLM responses using a novel dataset of CVEs that we manually annotated, evaluating performance to identify models, parameters, and strategies for a practical applicability in local environments resources limited. Preliminary results show that enriching the prompt by adding more context using embeddings can lead to encouraging performance in 5G CVE classification in limited settings with models under 14 billion of parameters, indicating potential advantages compared to large and frontier models which require higher inference computational costs.