用大模型自动生成可防御未知攻击的入侵检测规则
GenTI: Benchmarking LLMs for Autonomous IDPS Rule Generation for Unseen Attacks
- 基于大模型和结构化提示，将攻击样本转化为可部署的检测规则
- 规则生成准确率达89.4%，对未知攻击检测率提升至87.4%
- 适合安全研究员与自动化防御系统开发者使用
基于规则的入侵检测与防御系统（IDPS）虽能精准识别并阻止攻击，但依赖人工编写、签名驱动的规则使其难以应对新兴和零日威胁。现有公开数据集（如CICIDS2017、UNSW-NB15）侧重流量分类，缺乏支持自动规则合成的结构化信息。为此，我们提出生成式威胁情报框架GenTI，构建包含超过15万条来自Snort、Suricata、Emerging Threats的检测与防护规则，以及5万条YARA规则的数据集GTI，每条规则均标注协议行为、载荷签名、上下文关系、映射到网络威胁情报（CTI）及可操作响应类型（告警、丢弃、拒绝）。在此基础上，设计基于大模型的流水线，通过结构化提示工程、思维链（CoT）推理及验证闭环（CoVe）实现从分析师提示和代表性载荷到可部署规则的转化。生成规则在实时环境（Snort/Suricata）中评估，指标包括语法准确性、语义相似度、CTI覆盖率、安全有效性及对未知攻击的检测能力。实验表明，GenTI实例的综合规则质量得分为89.4%，CTI覆盖率达94.8%，未知攻击检测率从45%提升至87.4%，误报率由8.5%降至2.3%。整体上，GenTI建立了首个将规则级CTI与大模型自动化紧密结合的大规模基准，推动自适应、持续演进的IDPS发展。
原文摘要 · Abstract (English)
Rule-based Intrusion Detection and Prevention Systems (IDPS) offer precise attack detection as well as mitigation, however their manually crafted, signature-driven rules limit adaptability to emerging and zero-day threats. Additionally, existing public datasets (e.g., CICIDS2017, UNSW-NB15) focus on traffic classification and provide little structured information to support automatic rule synthesis or prevention logic. To address this gap, we propose Generative Thread Intelligence (GenTI) \footnote{GenTI refers to the proposed framework, and GTI refers to the dataset.} an LLM-driven benchmark for automatic generation of IDPS rules targeting unseen attacks. The dataset (GTI) aggregates over 150k detection and prevention rules from Snort, Suricata, Emerging Threats, as well as 50k YARA, each annotated with protocol behavior, payload signatures, contextual relationships, mappings to Cyber Threat Intelligence (CTI), along with actionable response types (alert, drop, reject). Moreover, on top of this corpus we design an LLM-based pipeline that transforms analyst prompts and representative payloads into deployable rules via structured prompt engineering, Chain-of-Thought (CoT) reasoning, as well as a Chain-of-Verification (CoVe) loop for syntactic, semantic, and security validation. The generated rules are executed in real time on (Snort/Suricata) and evaluated by syntax accuracy, semantic similarity, CTI coverage, security effectiveness as well as unseen attacks detection. Furthermore, our GenTI instantiation achieves a composite rule-quality score of 89.4\%, with 94.8\% CTI coverage, improving unseen attacks detection from 45\% to 87.4\% and reducing the false-positive rate from 8.5\% to 2.3\%. Overall, GenTI establishes the first large-scale benchmark that tightly couples rule-level CTI with LLM-based automation, enabling adaptive, self-evolving IDPS.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。