自动将威胁情报转化为精准检测规则，提升安全响应效率。
From Threat Intelligence to Detection: Knowledge-driven Enrichment and Template-based Rule Grounding for Automated Sigma Rule Generation
- 用知识库增强情报文本，再匹配已有规则模板生成新规则。
- 在真实攻击报告上验证，规则准确率和覆盖度显著优于现有方法。
- 适合安全团队快速构建定制化检测规则，尤其擅长应对新型攻击。
由于高级持续性威胁（APTs）的快速演化，动态将网络威胁情报（CTI）转化为可执行的检测能力至关重要。Sigma规则是现代威胁检测流程的核心，因其提供平台无关的检测逻辑表达，可转换为多种SIEM系统的查询语句。传统手动编写Sigma规则易出错且依赖大量专业知识，难以规模化；尽管存在开源与行业维护的规则仓库，但往往滞后于新兴威胁，需频繁适配不同运营环境。这凸显了针对演进攻击手法和特定场景动态生成规则的必要性。本文提出AUTOSIGMA，一种将非结构化CTI报告自动转化为相关Sigma规则的解决方案。该方案不依赖单一语言模型，而是结合结构化知识库增强输入、匹配现有规则库模板，并通过‘大模型作为裁判’机制迭代验证规则有效性。通过知识驱动增强、模板化规则固化与多阶段流程设计，AUTOSIGMA实现了高准确性、上下文感知且相关的规则生成。在多个真实APT报告与安全博客数据上的评估表明，AUTOSIGMA在规则有效性、相关性、MITRE ATT&CK技术覆盖度及对输入质量的鲁棒性方面均优于其他方案与纯LLM模型。
原文摘要 · Abstract (English)
Mechanisms for dynamically converting cyber threat intelligence (CTI) into actionable detection capabilities are necessary due to the rapid evolution of Advanced Persistent Threats (APTs). Sigma rules are an essential part of contemporary threat detection workflows because they offer a platform-independent framework for expressing detection logic that can be converted into particular queries across SIEM systems. Conventional techniques for manually crafting Sigma rules are prone to mistakes, and necessitate extensive knowledge, which restricts their scalability. Although there are open-source and industry-maintained Sigma rule repositories, they often fail to keep pace with emerging threats and require frequent customization to fit diverse operational environments. This emphasizes the necessity of dynamic rule generation that is adapted to evolving attack techniques as well as particular use cases. In this work, we design AUTOSIGMA, an automated solution for transforming unstructured CTI reports into relevant Sigma rules. Rather than relying solely on language models, AUTOSIGMA leverages a structured knowledge base to enrich partial inputs, matches the enriched content against a repository of existing Sigma rules, and then employs an LLM-as-a-Judge mechanism to iteratively validate the rules. By combining knowledge-driven enrichment, template-based rule grounding, and a multi-stage solution, AUTOSIGMA enables accurate, context-aware, and relevant rule generation. Evaluations across multiple real-world APT reports and multiple security blogs demonstrate that AUTOSIGMA outperforms alternative solutions and LLM models in rule validity, rule relevancy, MITRE ATT&CK technique coverage, and robustness to input quality. AUTOSIGMA's Demo: https://youtu.be/iSr6IurQ6BM
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。